a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435

Analysis

max time kernel
112s
max time network
10s
platform
windows7_x64
resource
win7
submitted
24/06/2020, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
Size 6.1MB
Sample200624-bf5hwgexfa
SHA256 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435
MD5 091a2b9be76399133fdeabc700e9c909
SHA1 a6a0655f5ef3b98c657cce477c3753324cc2989e
SHA512 77366d266d597d07167ad9dafe037cb50cfbbd0ca97847a771ba996a32edeb93e7d7dd1b7b3fba1472d79e82b8827fe1a315769ef7c6fece54ab64eeabdfb94f
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1852	explorer.exe
1580	explorer.exe
1920	explorer.exe
1948	spoolsv.exe
384	spoolsv.exe
688	spoolsv.exe
2020	spoolsv.exe
820	spoolsv.exe
1980	spoolsv.exe
1848	spoolsv.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1852	explorer.exe
1852	explorer.exe
1920	explorer.exe
1920	explorer.exe
1948	spoolsv.exe
1948	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
688	spoolsv.exe
688	spoolsv.exe
820	spoolsv.exe
820	spoolsv.exe
1848	spoolsv.exe
1848	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1852	explorer.exe
1948	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
688	spoolsv.exe
1920	explorer.exe
820	spoolsv.exe
1920	explorer.exe

Loads dropped DLL 13 IoCs

pid	Process
1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
1920	explorer.exe
1920	explorer.exe
1948	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
688	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
820	spoolsv.exe
1920	explorer.exe
1920	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Suspicious use of WriteProcessMemory 189 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1228	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	24
PID 1100 wrote to memory of 1228	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	24
PID 1100 wrote to memory of 1228	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	24
PID 1100 wrote to memory of 1228	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	24
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1100 wrote to memory of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1324 wrote to memory of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1800 wrote to memory of 1852	1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	31
PID 1800 wrote to memory of 1852	1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	31
PID 1800 wrote to memory of 1852	1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	31
PID 1800 wrote to memory of 1852	1800	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	31
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1920	1580	explorer.exe	35
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1580 wrote to memory of 1860	1580	explorer.exe	36
PID 1920 wrote to memory of 1948	1920	explorer.exe	37
PID 1920 wrote to memory of 1948	1920	explorer.exe	37
PID 1920 wrote to memory of 1948	1920	explorer.exe	37
PID 1920 wrote to memory of 1948	1920	explorer.exe	37
PID 1948 wrote to memory of 2000	1948	spoolsv.exe	38
PID 1948 wrote to memory of 2000	1948	spoolsv.exe	38
PID 1948 wrote to memory of 2000	1948	spoolsv.exe	38
PID 1948 wrote to memory of 2000	1948	spoolsv.exe	38
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1948 wrote to memory of 384	1948	spoolsv.exe	40
PID 1920 wrote to memory of 688	1920	explorer.exe	41
PID 1920 wrote to memory of 688	1920	explorer.exe	41
PID 1920 wrote to memory of 688	1920	explorer.exe	41
PID 1920 wrote to memory of 688	1920	explorer.exe	41
PID 688 wrote to memory of 1504	688	spoolsv.exe	42
PID 688 wrote to memory of 1504	688	spoolsv.exe	42
PID 688 wrote to memory of 1504	688	spoolsv.exe	42
PID 688 wrote to memory of 1504	688	spoolsv.exe	42
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 688 wrote to memory of 2020	688	spoolsv.exe	44
PID 1920 wrote to memory of 820	1920	explorer.exe	45
PID 1920 wrote to memory of 820	1920	explorer.exe	45
PID 1920 wrote to memory of 820	1920	explorer.exe	45
PID 1920 wrote to memory of 820	1920	explorer.exe	45
PID 820 wrote to memory of 1144	820	spoolsv.exe	46
PID 820 wrote to memory of 1144	820	spoolsv.exe	46
PID 820 wrote to memory of 1144	820	spoolsv.exe	46
PID 820 wrote to memory of 1144	820	spoolsv.exe	46
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 820 wrote to memory of 1980	820	spoolsv.exe	48
PID 1920 wrote to memory of 1848	1920	explorer.exe	49
PID 1920 wrote to memory of 1848	1920	explorer.exe	49
PID 1920 wrote to memory of 1848	1920	explorer.exe	49
PID 1920 wrote to memory of 1848	1920	explorer.exe	49
PID 1848 wrote to memory of 1856	1848	spoolsv.exe	50
PID 1848 wrote to memory of 1856	1848	spoolsv.exe	50
PID 1848 wrote to memory of 1856	1848	spoolsv.exe	50
PID 1848 wrote to memory of 1856	1848	spoolsv.exe	50

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 1324	1100	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	26
PID 1324 set thread context of 1800	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	29
PID 1324 set thread context of 1312	1324	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe	30
PID 1852 set thread context of 1580	1852	explorer.exe	34
PID 1580 set thread context of 1920	1580	explorer.exe	35
PID 1580 set thread context of 1860	1580	explorer.exe	36
PID 1948 set thread context of 384	1948	spoolsv.exe	40
PID 688 set thread context of 2020	688	spoolsv.exe	44
PID 820 set thread context of 1980	820	spoolsv.exe	48

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
"C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
  C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
  2⤵
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
    C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious behavior: EnumeratesProcesses
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    - Drops file in Windows directory
    PID:1800
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1732
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        
        PID:1580
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Executes dropped EXE
        Adds Run entry to start application
        Modifies WinLogon for persistence
        Modifies Installed Components in the registry
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Loads dropped DLL
        Modifies the visibility of hidden or system files
        Drops file in Windows directory
        
        PID:1920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:384
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1504
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2020
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1144
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1980
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Drops file in Windows directory
        
        PID:1848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1856
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1860
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-71-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1312-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1312-12-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1324-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1324-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1324-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1580-32-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1800-30-0x00000000004D0000-0x00000000004D4000-memory.dmp

Download

memory/1800-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-31-0x0000000002660000-0x0000000002664000-memory.dmp

Download

memory/1800-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-18-0x0000000002D20000-0x0000000002D31000-memory.dmp

Download

memory/1800-15-0x0000000002D20000-0x0000000002D31000-memory.dmp

Download

memory/1800-16-0x0000000003130000-0x0000000003141000-memory.dmp

Download

memory/1920-61-0x00000000030A0000-0x00000000030B1000-memory.dmp

Download

memory/1920-93-0x00000000030A0000-0x00000000030B1000-memory.dmp

Download

memory/1920-75-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Download

memory/1920-58-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Download

memory/1920-59-0x00000000030A0000-0x00000000030B1000-memory.dmp

Download

memory/1920-60-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Download

memory/1920-90-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Download

memory/1920-77-0x00000000030A0000-0x00000000030B1000-memory.dmp

Download