Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 19:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe
-
Size
87KB
-
MD5
debe698c3b33ab7a6c2081e6545249c2
-
SHA1
257377217fabf3778cb267cd8a744da0b7e76b96
-
SHA256
01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605
-
SHA512
dfac6ef6ed14693281319fd67d2b20479a1d081914c17caf08cc519ad04b2868c42fbeab062d1863b3df21c9da6201f6dfd051c1dc4e3a006ed4c9eb19bf0e2d
-
SSDEEP
1536:1a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3ldoIH:08dfX7y9DZ+N7eB+IIH
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe -
Executes dropped EXE 12 IoCs
pid Process 2740 SVCHOST.EXE 1512 SVCHOST.EXE 4272 SVCHOST.EXE 3680 SVCHOST.EXE 3872 SVCHOST.EXE 1732 SPOOLSV.EXE 2848 SVCHOST.EXE 3940 SVCHOST.EXE 4944 SPOOLSV.EXE 1600 SPOOLSV.EXE 1572 SVCHOST.EXE 3492 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened for modification F:\Recycled\desktop.ini 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\P: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\G: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\U: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\O: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\Q: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\R: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\K: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\L: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\M: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\E: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\H: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\J: 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\TileInfo = "prop:Type;Size" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\*\QuickTip = "prop:Type;Size" 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2460 WINWORD.EXE 2460 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 1732 SPOOLSV.EXE 1732 SPOOLSV.EXE 4272 SVCHOST.EXE 4272 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 2740 SVCHOST.EXE 1512 SVCHOST.EXE 4272 SVCHOST.EXE 3680 SVCHOST.EXE 3872 SVCHOST.EXE 1732 SPOOLSV.EXE 2848 SVCHOST.EXE 3940 SVCHOST.EXE 4944 SPOOLSV.EXE 1600 SPOOLSV.EXE 1572 SVCHOST.EXE 3492 SPOOLSV.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE 2460 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2740 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 82 PID 2364 wrote to memory of 2740 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 82 PID 2364 wrote to memory of 2740 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 82 PID 2740 wrote to memory of 1512 2740 SVCHOST.EXE 83 PID 2740 wrote to memory of 1512 2740 SVCHOST.EXE 83 PID 2740 wrote to memory of 1512 2740 SVCHOST.EXE 83 PID 2740 wrote to memory of 4272 2740 SVCHOST.EXE 84 PID 2740 wrote to memory of 4272 2740 SVCHOST.EXE 84 PID 2740 wrote to memory of 4272 2740 SVCHOST.EXE 84 PID 4272 wrote to memory of 3680 4272 SVCHOST.EXE 85 PID 4272 wrote to memory of 3680 4272 SVCHOST.EXE 85 PID 4272 wrote to memory of 3680 4272 SVCHOST.EXE 85 PID 4272 wrote to memory of 3872 4272 SVCHOST.EXE 86 PID 4272 wrote to memory of 3872 4272 SVCHOST.EXE 86 PID 4272 wrote to memory of 3872 4272 SVCHOST.EXE 86 PID 4272 wrote to memory of 1732 4272 SVCHOST.EXE 87 PID 4272 wrote to memory of 1732 4272 SVCHOST.EXE 87 PID 4272 wrote to memory of 1732 4272 SVCHOST.EXE 87 PID 1732 wrote to memory of 2848 1732 SPOOLSV.EXE 88 PID 1732 wrote to memory of 2848 1732 SPOOLSV.EXE 88 PID 1732 wrote to memory of 2848 1732 SPOOLSV.EXE 88 PID 1732 wrote to memory of 3940 1732 SPOOLSV.EXE 89 PID 1732 wrote to memory of 3940 1732 SPOOLSV.EXE 89 PID 1732 wrote to memory of 3940 1732 SPOOLSV.EXE 89 PID 1732 wrote to memory of 4944 1732 SPOOLSV.EXE 90 PID 1732 wrote to memory of 4944 1732 SPOOLSV.EXE 90 PID 1732 wrote to memory of 4944 1732 SPOOLSV.EXE 90 PID 2740 wrote to memory of 1600 2740 SVCHOST.EXE 91 PID 2740 wrote to memory of 1600 2740 SVCHOST.EXE 91 PID 2740 wrote to memory of 1600 2740 SVCHOST.EXE 91 PID 2364 wrote to memory of 1572 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 92 PID 2364 wrote to memory of 1572 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 92 PID 2364 wrote to memory of 1572 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 92 PID 2364 wrote to memory of 3492 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 93 PID 2364 wrote to memory of 3492 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 93 PID 2364 wrote to memory of 3492 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 93 PID 2364 wrote to memory of 2460 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 94 PID 2364 wrote to memory of 2460 2364 01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe"C:\Users\Admin\AppData\Local\Temp\01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3680
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3872
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3940
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4944
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3492
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\01dd2184eb71969187a3291afe9c59e93c3c9b9a97a8416e33ed7660c1a62605.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD58fff996bc4e522823c74c8ccc23d31a8
SHA12bdfaf88d16a1bacb5bdf1b1194a586acaeeb642
SHA256fe2021b8df7c81690ffdf9a3b24c44cff637008db664f032b62358575d93e256
SHA512123bb1e29a4891c3e400663c965e11363fe0c867b3450b9b44b30f7f45379298c1a21ab302c8acc3e77008d802988c4f61c8bfc58569b55b21a6c258c7ed29ac
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD55515830dbbd29f7de99bc1d4ca144527
SHA1d77c53c00074c5009069eb734f42677d3298ee23
SHA25642d1a7d45582b84e5e4b0008fdfe50d2d060be1df72a0d4adc702a1510fcf9a7
SHA51222484d191ff3ae91889321e000807df2ebed051d64c899768a395299c0c0c4d2843dad5e4caa5fc86612c78cdaf30e7aeaecfeb34d946a86712ec0a44b4b9375
-
Filesize
87KB
MD51bef08151c62037c76c22f887496bd4f
SHA1345e151ce6442fa874d65bdb69cf3b60099de3b0
SHA25615b69d67d84e32470c0c92a351b7ae2c95f1cb0a2f354038259263415cab04a0
SHA512ed42acf83cfafca5843ec878023adb5dce3ad3ff76bfa3a93b8129a5e872793f7709cb60033ea079e86837822f0ab026d465c5614ddc62bb0e42ba41ae0ab857
-
Filesize
87KB
MD5f9dc286af89fdccfd614498cde3d9285
SHA125e79c77dde20df5d75e8a4fae4b65255469fd78
SHA256d11de5818d512a528262254d5dc89d754209afdb9872df4461ee15d2cddcb519
SHA512b28ce1c3858d79a2deba60c0f09398870d6261f91b703b487521fe2e633ec410d5bfec215eeb46c9f9e9797d651de21ec4e59406efaa50b8bf837fde439cce8a
-
Filesize
87KB
MD57e6c946b9e8a84aaf3e4149a5d0d8992
SHA1a0f8d8aaa26254f7440a6ade0bf1c2cc66f5d956
SHA256c6591793f53cc2853589d7b4711ee7eac1cc82f53dcbf6e9fbd6435f6ca47543
SHA51204c72e7420bbd1b6996d78990421d2d17c3e439ae50298cc9cf7fb56274e809fc8ef6ec0943a2b0531b65d0c7dfb21416d05c587b077db477cd853c52c85a0be
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
87KB
MD5b4f1b64e7538eb7d8aca479835e91cde
SHA1b281f5d556205e6665ba2cb8847e983d1c3138de
SHA256b374723e060d2a54cf6b027ad6d42cae48be2baefc902c73db55ef5add087423
SHA512c5ce8bcf02f28dcd08b9ee12aea5c60833120497d0a820a139b57384148f63832bcb32ba76f243e9978d2fb2475038193946a4743c421dbfa28bb4e9a8f290c2
-
Filesize
87KB
MD53c632e96482b53b5ab2f8e39b8a34052
SHA1ec865d90bd1bec76f57cffd447ae18a31f4e0308
SHA25606a1d9f1fb51552f894ee4bcc382ccffd32235866fe343cb93b5e3af1c787c83
SHA512ef08be7676984cafd5f1b205b3ba6ccf21b1fb9124831e0eb5b9d84c2732272c50167d0d6d64a1e8590f22b751a9db064ffefabd2a04a1e6becb5d2beddbf1a7