Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe
- Size 76KB
- Sample260912-1dvy9sac83
- SHA256 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac
- MD5 bc79e892ad819c7086eeb6868df2cc38
- SHA1 5983c00fccd1dcd588d0f1d704014c876503ecd5
- SHA512 722c31a6a83ff43c7e8c80cf4dc0ff4e6ace9db25bcb40700386c52f1c12565c8cc9a94b9b4a392e43c1502dc0763e92d8768f50616b7017ec852443e78c47e0
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIC:T0aXdfXAyy9DZ+N7eB+IIC
- TLSH T198734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE - Modifies visibility of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Executes dropped EXE 12 IoCs
pid Process 5096 SVCHOST.EXE 1532 SVCHOST.EXE 4628 SVCHOST.EXE 1908 SVCHOST.EXE 3840 SVCHOST.EXE 4736 SPOOLSV.EXE 4040 SVCHOST.EXE 5820 SVCHOST.EXE 4704 SPOOLSV.EXE 5116 SPOOLSV.EXE 6028 SVCHOST.EXE 2904 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened for modification F:\Recycled\desktop.ini a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\P: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\X: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Q: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\E: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\S: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\Z: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\K: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\M: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\V: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\H: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\U: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Y: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\N: a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\QuickTip = "prop:Type;Size" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\TileInfo = "prop:Type;Size" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\InfoTip = "prop:Type;Write;Size" a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 392 WINWORD.EXE 392 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 5096 SVCHOST.EXE 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4628 SVCHOST.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE 4736 SPOOLSV.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 5096 SVCHOST.EXE 1532 SVCHOST.EXE 4628 SVCHOST.EXE 1908 SVCHOST.EXE 3840 SVCHOST.EXE 4736 SPOOLSV.EXE 4040 SVCHOST.EXE 5820 SVCHOST.EXE 4704 SPOOLSV.EXE 5116 SPOOLSV.EXE 6028 SVCHOST.EXE 2904 SPOOLSV.EXE 392 WINWORD.EXE 392 WINWORD.EXE 392 WINWORD.EXE 392 WINWORD.EXE 392 WINWORD.EXE 392 WINWORD.EXE 392 WINWORD.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4668 wrote to memory of 5096 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 87 PID 5096 wrote to memory of 1532 5096 SVCHOST.EXE 88 PID 5096 wrote to memory of 4628 5096 SVCHOST.EXE 89 PID 4628 wrote to memory of 1908 4628 SVCHOST.EXE 90 PID 4628 wrote to memory of 3840 4628 SVCHOST.EXE 91 PID 4628 wrote to memory of 4736 4628 SVCHOST.EXE 92 PID 4736 wrote to memory of 4040 4736 SPOOLSV.EXE 93 PID 4736 wrote to memory of 5820 4736 SPOOLSV.EXE 94 PID 4736 wrote to memory of 4704 4736 SPOOLSV.EXE 95 PID 5096 wrote to memory of 5116 5096 SVCHOST.EXE 96 PID 4668 wrote to memory of 6028 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 97 PID 4668 wrote to memory of 2904 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 98 PID 4668 wrote to memory of 392 4668 a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe"C:\Users\Admin\AppData\Local\Temp\a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3840
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5820
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4704
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6028
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a805086dea93b4b641d623f0c6575df98598e04890e19581ece60b200731ecac.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:392
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 76KB
- SHA256 ad03b799c9e9750b8eaba37345a684897bb1ebc46c1634d237d6c22274dac73a
- MD5 83a6d0deac7b91dce5f0ae224f7ca587
- SHA1 320c3fdb49ade3878ccf316af43014e956129ec7
- SHA512 acfbac7a8e7d1e86aae3d5ae62cea548f8341d8342b82b62b966208272783a2b157e26282e879a3f810819bde8d1d1de956c67402c58ff83374b431468b47164
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIw:T0aXdfXAyy9DZ+N7eB+IIw
- TLSH T1AA734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Recycled\SVCHOST.EXE
- Size 76KB
- SHA256 232334a11b9c469f392c471553e9b526cb8e309a39140747bc8023ca771ed9db
- MD5 34344da09c5e08e4bb91014f137636f8
- SHA1 eca97eb5c5c7ed24569d22db40beabbf2697868a
- SHA512 d3be511e5f8ae8b83f434a14ffcde994e0ea87b80ad4add2edfa2f35b1bbd1fd0ef74a6398c432e5dbd6a333dbfa64b79f3fff1e1cc47b5cbfe7ae38ab25582c
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIM:T0aXdfXAyy9DZ+N7eB+IIM
- TLSH T1D1734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- TLSH T1654176420F83200B08461FECA5FCE82BBC991E53675796670D545FB55693FB476C708C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD1033.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 fa6f873c7bb0451f65bbd73f1b6399aaba79ad01da366b983ee38b176a154999
- MD5 05723493b3200b2166817232818f43fd
- SHA1 33ed0fea966bb9680fd24edfbeb316b179ee8f0d
- SHA512 5a6f60be5b629d3a8f81f6daf2b5f5ed73e4d6ecdbec3d8042f02118fde6cbebfa53126628f8f3b013dd41b4f619f8b311e9b542a24166f70cc84114dbe0b24a
- TLSH T1AD2103416ACB27D7F095513A5636A315FBF0BC57F701710D960AB11F5C34E001B8DAAA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Fonts\ Explorer.exe
- Size 76KB
- SHA256 570348191a10776593acb1eb9ab6ca0a1cf07fe293d3fcfac9aa1523fdbdb7a9
- MD5 82f8abe1ee59f1b4dcc855c034cd3131
- SHA1 ae0b112062aa29cd5e7008aa9db92941b31bd251
- SHA512 8994fefdfd12735c13d8ebd696e2419d4b1a30840d8bdcb04d99129c3417d72c88deca6582da2c1100ef73971e24c88e4a9829861f0df4f322c33fe474e0f369
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoI5:T0aXdfXAyy9DZ+N7eB+II5
- TLSH T126734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Fonts\ Explorer.exe
- Size 76KB
- SHA256 fec990317e34cb0da97b25e1acc10cca4a6d6d9dbd8f1d5c9bdb9190c3b3c887
- MD5 327e56f49eddf746432de7209d91fe1e
- SHA1 54167cdd4c8305e919d21f31db875331b08dd837
- SHA512 c32644a9bfa50cdb1c9c783ce7e6c995f4aa9740026d2c3ef88bb6b6f6104ce0737abe69ba146fc7375262698d20e9032c41f76e411e661b583aacfa5831e671
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIC:T0aXdfXAyy9DZ+N7eB+IIC
- TLSH T1AC734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Fonts\ Explorer.exe
- Size 76KB
- SHA256 a7de448c07ec58244836669bf60a2ebeb1f22835688e94ee163d757390168b27
- MD5 36f3b4ebc0e09b37712f00a29bdb3827
- SHA1 bfd3600e814d9182065474c07eb224253ec576b7
- SHA512 3e522bed7ba7e1c801a431572017113aa64b1b5e8be50be1b691a30762c1b483e7305d5dd6b719eb3a3156ae019f00bd600d890647603a93fd6618b00412a78d
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIf:T0aXdfXAyy9DZ+N7eB+IIf
- TLSH T1E7734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 76KB
- SHA256 0fda2a653890802081cc309d4981f8951c402524a6199439bb2fba4d00f195e2
- MD5 32bf41162d994f0e4a055a43e0c27f9a
- SHA1 4f78ddfa0b66b3cba570519e8d8986b93592a993
- SHA512 e9f55b375a7953e19694ee2004b9b21710d19670de1bf903774017f186597069d95117364226a665019051738f482ee9e34b19afe3794bb479f5efd02c44b441
- SSDEEP 1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoI0:T0aXdfXAyy9DZ+N7eB+II0
- TLSH T138734B1BB7CC5857EAA7273A65A785F89633785E6B438B476054333A2C32F022D27743
- MD5 SHA1 SHA512 SSDEEP TLSH