Analysis
- max time kernel
142s - max time network
34s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe
- Size 6.1MB
- Sample200624-bf5hwgexfa
- SHA256 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435
- MD5 091a2b9be76399133fdeabc700e9c909
- SHA1 a6a0655f5ef3b98c657cce477c3753324cc2989e
- SHA512 77366d266d597d07167ad9dafe037cb50cfbbd0ca97847a771ba996a32edeb93e7d7dd1b7b3fba1472d79e82b8827fe1a315769ef7c6fece54ab64eeabdfb94f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3352 explorer.exe 3352 explorer.exe 1444 explorer.exe 1444 explorer.exe 1656 spoolsv.exe 1656 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 2308 spoolsv.exe 2308 spoolsv.exe 3648 spoolsv.exe 3648 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 3396 spoolsv.exe 3396 spoolsv.exe 2216 spoolsv.exe 2216 spoolsv.exe 3700 spoolsv.exe 3700 spoolsv.exe 2984 spoolsv.exe 2984 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 1068 spoolsv.exe 1068 spoolsv.exe 3368 spoolsv.exe 3368 spoolsv.exe - Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 3536 set thread context of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 4064 set thread context of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 set thread context of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 3352 set thread context of 3524 3352 explorer.exe 75 PID 3524 set thread context of 1444 3524 explorer.exe 82 PID 1656 set thread context of 2124 1656 spoolsv.exe 87 PID 2308 set thread context of 2952 2308 spoolsv.exe 91 PID 3648 set thread context of 4068 3648 spoolsv.exe 95 PID 3740 set thread context of 2516 3740 spoolsv.exe 99 PID 3396 set thread context of 1260 3396 spoolsv.exe 103 PID 2216 set thread context of 1292 2216 spoolsv.exe 107 PID 3700 set thread context of 1456 3700 spoolsv.exe 111 PID 2984 set thread context of 3796 2984 spoolsv.exe 115 PID 2712 set thread context of 2308 2712 spoolsv.exe 119 PID 1068 set thread context of 1664 1068 spoolsv.exe 123 - Executes dropped EXE 24 IoCs
pid Process 3352 explorer.exe 3524 explorer.exe 1444 explorer.exe 1656 spoolsv.exe 2124 spoolsv.exe 2308 spoolsv.exe 2952 spoolsv.exe 3648 spoolsv.exe 4068 spoolsv.exe 3740 spoolsv.exe 2516 spoolsv.exe 3396 spoolsv.exe 1260 spoolsv.exe 2216 spoolsv.exe 1292 spoolsv.exe 3700 spoolsv.exe 1456 spoolsv.exe 2984 spoolsv.exe 3796 spoolsv.exe 2712 spoolsv.exe 2308 spoolsv.exe 1068 spoolsv.exe 1664 spoolsv.exe 3368 spoolsv.exe - Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe - Suspicious use of WriteProcessMemory 449 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3800 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 67 PID 3536 wrote to memory of 3800 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 67 PID 3536 wrote to memory of 3800 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 67 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 3536 wrote to memory of 4064 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 69 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3816 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 70 PID 4064 wrote to memory of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 4064 wrote to memory of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 4064 wrote to memory of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 4064 wrote to memory of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 4064 wrote to memory of 3904 4064 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 71 PID 3816 wrote to memory of 3352 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 72 PID 3816 wrote to memory of 3352 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 72 PID 3816 wrote to memory of 3352 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 72 PID 3352 wrote to memory of 3568 3352 explorer.exe 73 PID 3352 wrote to memory of 3568 3352 explorer.exe 73 PID 3352 wrote to memory of 3568 3352 explorer.exe 73 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3352 wrote to memory of 3524 3352 explorer.exe 75 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 1444 3524 explorer.exe 82 PID 3524 wrote to memory of 4004 3524 explorer.exe 83 PID 3524 wrote to memory of 4004 3524 explorer.exe 83 PID 3524 wrote to memory of 4004 3524 explorer.exe 83 PID 1444 wrote to memory of 1656 1444 explorer.exe 84 PID 1444 wrote to memory of 1656 1444 explorer.exe 84 PID 1444 wrote to memory of 1656 1444 explorer.exe 84 PID 1656 wrote to memory of 1864 1656 spoolsv.exe 85 PID 1656 wrote to memory of 1864 1656 spoolsv.exe 85 PID 1656 wrote to memory of 1864 1656 spoolsv.exe 85 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1656 wrote to memory of 2124 1656 spoolsv.exe 87 PID 1444 wrote to memory of 2308 1444 explorer.exe 88 PID 1444 wrote to memory of 2308 1444 explorer.exe 88 PID 1444 wrote to memory of 2308 1444 explorer.exe 88 PID 2308 wrote to memory of 2680 2308 spoolsv.exe 89 PID 2308 wrote to memory of 2680 2308 spoolsv.exe 89 PID 2308 wrote to memory of 2680 2308 spoolsv.exe 89 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 2308 wrote to memory of 2952 2308 spoolsv.exe 91 PID 1444 wrote to memory of 3648 1444 explorer.exe 92 PID 1444 wrote to memory of 3648 1444 explorer.exe 92 PID 1444 wrote to memory of 3648 1444 explorer.exe 92 PID 3648 wrote to memory of 3020 3648 spoolsv.exe 93 PID 3648 wrote to memory of 3020 3648 spoolsv.exe 93 PID 3648 wrote to memory of 3020 3648 spoolsv.exe 93 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 3648 wrote to memory of 4068 3648 spoolsv.exe 95 PID 1444 wrote to memory of 3740 1444 explorer.exe 96 PID 1444 wrote to memory of 3740 1444 explorer.exe 96 PID 1444 wrote to memory of 3740 1444 explorer.exe 96 PID 3740 wrote to memory of 3788 3740 spoolsv.exe 97 PID 3740 wrote to memory of 3788 3740 spoolsv.exe 97 PID 3740 wrote to memory of 3788 3740 spoolsv.exe 97 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 3740 wrote to memory of 2516 3740 spoolsv.exe 99 PID 1444 wrote to memory of 3396 1444 explorer.exe 100 PID 1444 wrote to memory of 3396 1444 explorer.exe 100 PID 1444 wrote to memory of 3396 1444 explorer.exe 100 PID 3396 wrote to memory of 3888 3396 spoolsv.exe 101 PID 3396 wrote to memory of 3888 3396 spoolsv.exe 101 PID 3396 wrote to memory of 3888 3396 spoolsv.exe 101 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 3396 wrote to memory of 1260 3396 spoolsv.exe 103 PID 1444 wrote to memory of 2216 1444 explorer.exe 104 PID 1444 wrote to memory of 2216 1444 explorer.exe 104 PID 1444 wrote to memory of 2216 1444 explorer.exe 104 PID 2216 wrote to memory of 2512 2216 spoolsv.exe 105 PID 2216 wrote to memory of 2512 2216 spoolsv.exe 105 PID 2216 wrote to memory of 2512 2216 spoolsv.exe 105 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 2216 wrote to memory of 1292 2216 spoolsv.exe 107 PID 1444 wrote to memory of 3700 1444 explorer.exe 108 PID 1444 wrote to memory of 3700 1444 explorer.exe 108 PID 1444 wrote to memory of 3700 1444 explorer.exe 108 PID 3700 wrote to memory of 484 3700 spoolsv.exe 109 PID 3700 wrote to memory of 484 3700 spoolsv.exe 109 PID 3700 wrote to memory of 484 3700 spoolsv.exe 109 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 3700 wrote to memory of 1456 3700 spoolsv.exe 111 PID 1444 wrote to memory of 2984 1444 explorer.exe 112 PID 1444 wrote to memory of 2984 1444 explorer.exe 112 PID 1444 wrote to memory of 2984 1444 explorer.exe 112 PID 2984 wrote to memory of 1624 2984 spoolsv.exe 113 PID 2984 wrote to memory of 1624 2984 spoolsv.exe 113 PID 2984 wrote to memory of 1624 2984 spoolsv.exe 113 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 2984 wrote to memory of 3796 2984 spoolsv.exe 115 PID 1444 wrote to memory of 2712 1444 explorer.exe 116 PID 1444 wrote to memory of 2712 1444 explorer.exe 116 PID 1444 wrote to memory of 2712 1444 explorer.exe 116 PID 2712 wrote to memory of 2156 2712 spoolsv.exe 117 PID 2712 wrote to memory of 2156 2712 spoolsv.exe 117 PID 2712 wrote to memory of 2156 2712 spoolsv.exe 117 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 2712 wrote to memory of 2308 2712 spoolsv.exe 119 PID 1444 wrote to memory of 1068 1444 explorer.exe 120 PID 1444 wrote to memory of 1068 1444 explorer.exe 120 PID 1444 wrote to memory of 1068 1444 explorer.exe 120 PID 1068 wrote to memory of 3136 1068 spoolsv.exe 121 PID 1068 wrote to memory of 3136 1068 spoolsv.exe 121 PID 1068 wrote to memory of 3136 1068 spoolsv.exe 121 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1068 wrote to memory of 1664 1068 spoolsv.exe 123 PID 1444 wrote to memory of 3368 1444 explorer.exe 124 PID 1444 wrote to memory of 3368 1444 explorer.exe 124 PID 1444 wrote to memory of 3368 1444 explorer.exe 124 PID 3368 wrote to memory of 3760 3368 spoolsv.exe 125 PID 3368 wrote to memory of 3760 3368 spoolsv.exe 125 PID 3368 wrote to memory of 3760 3368 spoolsv.exe 125 PID 3368 wrote to memory of 2860 3368 spoolsv.exe 127 PID 3368 wrote to memory of 2860 3368 spoolsv.exe 127 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3536 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3816 a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe 3352 explorer.exe 3352 explorer.exe 1656 spoolsv.exe 1656 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 1444 explorer.exe 1444 explorer.exe 2308 spoolsv.exe 2308 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 3648 spoolsv.exe 3648 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 3740 spoolsv.exe 3740 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 3396 spoolsv.exe 3396 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 2216 spoolsv.exe 2216 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 3700 spoolsv.exe 3700 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 2984 spoolsv.exe 2984 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 2712 spoolsv.exe 2712 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 1068 spoolsv.exe 1068 spoolsv.exe 1444 explorer.exe 1444 explorer.exe 3368 spoolsv.exe 3368 spoolsv.exe - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Modifies the visibility of hidden or system files 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe - Adds Run entry to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe"C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:3800
-
-
C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exeC:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exeC:\Users\Admin\AppData\Local\Temp\a54b5b4111c81f54e792a33bfb2c90e39760b2b7e9e86e3848d57c074e3b7435.exe3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:3568
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Adds Run entry to start application
PID:3524 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Modifies WinLogon for persistence
- Modifies the visibility of hidden or system files
- Adds Run entry to start application
- Drops file in Windows directory
PID:1444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1260
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:484
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3796
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2156
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2308
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3136
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2860
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4004
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:3904
-
-