38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837

Analysis

max time kernel
120s
max time network
6s
platform
windows7_x64
resource
win7v200430
submitted
24/06/2020, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
Size 6.1MB
Sample200624-ym8ajctmvs
SHA256 38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837
MD5 70057800e874e1e2ca6f38e4d7757a60
SHA1 40ec177296db7827c4c448fed531bac8402a7444
SHA512 9f26bb7a659708e7ccfc77f26fb4bc43578f1d4a8651fed09621e4ca8312a56a90e0366b1244dadb73266c532b03f21107d6b87ec9e36817cf8d815967d00b6a
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Loads dropped DLL 16 IoCs

pid	Process
1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
1580	explorer.exe
1580	explorer.exe
1928	spoolsv.exe
1580	explorer.exe
1580	explorer.exe
1492	spoolsv.exe
1580	explorer.exe
1580	explorer.exe
1092	spoolsv.exe
1580	explorer.exe
1580	explorer.exe
976	spoolsv.exe
1580	explorer.exe
1580	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
916	explorer.exe
916	explorer.exe
1580	explorer.exe
1580	explorer.exe
1928	spoolsv.exe
1928	spoolsv.exe
1580	explorer.exe
1580	explorer.exe
1492	spoolsv.exe
1492	spoolsv.exe
1092	spoolsv.exe
1092	spoolsv.exe
976	spoolsv.exe
976	spoolsv.exe

Suspicious use of WriteProcessMemory 216 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1100	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	24
PID 240 wrote to memory of 1100	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	24
PID 240 wrote to memory of 1100	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	24
PID 240 wrote to memory of 1100	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	24
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 240 wrote to memory of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1056 wrote to memory of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 1872 wrote to memory of 916	1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	31
PID 1872 wrote to memory of 916	1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	31
PID 1872 wrote to memory of 916	1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	31
PID 1872 wrote to memory of 916	1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	31
PID 916 wrote to memory of 1204	916	explorer.exe	32
PID 916 wrote to memory of 1204	916	explorer.exe	32
PID 916 wrote to memory of 1204	916	explorer.exe	32
PID 916 wrote to memory of 1204	916	explorer.exe	32
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 916 wrote to memory of 1352	916	explorer.exe	34
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1580	1352	explorer.exe	35
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1352 wrote to memory of 1540	1352	explorer.exe	36
PID 1580 wrote to memory of 1928	1580	explorer.exe	37
PID 1580 wrote to memory of 1928	1580	explorer.exe	37
PID 1580 wrote to memory of 1928	1580	explorer.exe	37
PID 1580 wrote to memory of 1928	1580	explorer.exe	37
PID 1928 wrote to memory of 2004	1928	spoolsv.exe	38
PID 1928 wrote to memory of 2004	1928	spoolsv.exe	38
PID 1928 wrote to memory of 2004	1928	spoolsv.exe	38
PID 1928 wrote to memory of 2004	1928	spoolsv.exe	38
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1928 wrote to memory of 2020	1928	spoolsv.exe	40
PID 1580 wrote to memory of 1492	1580	explorer.exe	41
PID 1580 wrote to memory of 1492	1580	explorer.exe	41
PID 1580 wrote to memory of 1492	1580	explorer.exe	41
PID 1580 wrote to memory of 1492	1580	explorer.exe	41
PID 1492 wrote to memory of 1048	1492	spoolsv.exe	42
PID 1492 wrote to memory of 1048	1492	spoolsv.exe	42
PID 1492 wrote to memory of 1048	1492	spoolsv.exe	42
PID 1492 wrote to memory of 1048	1492	spoolsv.exe	42
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1492 wrote to memory of 1472	1492	spoolsv.exe	44
PID 1580 wrote to memory of 1092	1580	explorer.exe	45
PID 1580 wrote to memory of 1092	1580	explorer.exe	45
PID 1580 wrote to memory of 1092	1580	explorer.exe	45
PID 1580 wrote to memory of 1092	1580	explorer.exe	45
PID 1092 wrote to memory of 1820	1092	spoolsv.exe	46
PID 1092 wrote to memory of 1820	1092	spoolsv.exe	46
PID 1092 wrote to memory of 1820	1092	spoolsv.exe	46
PID 1092 wrote to memory of 1820	1092	spoolsv.exe	46
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1092 wrote to memory of 420	1092	spoolsv.exe	48
PID 1580 wrote to memory of 976	1580	explorer.exe	49
PID 1580 wrote to memory of 976	1580	explorer.exe	49
PID 1580 wrote to memory of 976	1580	explorer.exe	49
PID 1580 wrote to memory of 976	1580	explorer.exe	49
PID 976 wrote to memory of 1268	976	spoolsv.exe	50
PID 976 wrote to memory of 1268	976	spoolsv.exe	50
PID 976 wrote to memory of 1268	976	spoolsv.exe	50
PID 976 wrote to memory of 1268	976	spoolsv.exe	50
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 976 wrote to memory of 1752	976	spoolsv.exe	52
PID 1580 wrote to memory of 460	1580	explorer.exe	53
PID 1580 wrote to memory of 460	1580	explorer.exe	53
PID 1580 wrote to memory of 460	1580	explorer.exe	53
PID 1580 wrote to memory of 460	1580	explorer.exe	53

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
1872	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
916	explorer.exe
1928	spoolsv.exe
1580	explorer.exe
1580	explorer.exe
1492	spoolsv.exe
1580	explorer.exe
1092	spoolsv.exe
1580	explorer.exe
976	spoolsv.exe
1580	explorer.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 240 set thread context of 1056	240	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	26
PID 1056 set thread context of 1872	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	29
PID 1056 set thread context of 1896	1056	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	30
PID 916 set thread context of 1352	916	explorer.exe	34
PID 1352 set thread context of 1580	1352	explorer.exe	35
PID 1352 set thread context of 1540	1352	explorer.exe	36
PID 1928 set thread context of 2020	1928	spoolsv.exe	40
PID 1492 set thread context of 1472	1492	spoolsv.exe	44
PID 1092 set thread context of 420	1092	spoolsv.exe	48
PID 976 set thread context of 1752	976	spoolsv.exe	52

Executes dropped EXE 12 IoCs

pid	Process
916	explorer.exe
1352	explorer.exe
1580	explorer.exe
1928	spoolsv.exe
2020	spoolsv.exe
1492	spoolsv.exe
1472	spoolsv.exe
1092	spoolsv.exe
420	spoolsv.exe
976	spoolsv.exe
1752	spoolsv.exe
460	spoolsv.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
"C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
  C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
  2⤵
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
    C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: EnumeratesProcesses
    - Drops file in Windows directory
    PID:1872
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Drops file in Windows directory
      PID:916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1204
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:1352
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Loads dropped DLL
        Modifies Installed Components in the registry
        Modifies the visibility of hidden or system files
        Adds Run entry to start application
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Executes dropped EXE
        Drops file in Windows directory
        Modifies WinLogon for persistence
        
        PID:1580
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2020
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1048
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1472
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1820
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1268
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        
        PID:460
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1540
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-102-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1056-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1056-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1056-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1352-32-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1472-87-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1580-77-0x00000000032D0000-0x00000000032E1000-memory.dmp

Download

memory/1580-59-0x00000000032D0000-0x00000000032E1000-memory.dmp

Download

memory/1580-109-0x00000000032D0000-0x00000000032E1000-memory.dmp

Download

memory/1580-108-0x0000000002EC0000-0x0000000002ED1000-memory.dmp

Download

memory/1580-93-0x00000000032D0000-0x00000000032E1000-memory.dmp

Download

memory/1580-61-0x00000000032D0000-0x00000000032E1000-memory.dmp

Download

memory/1580-60-0x0000000002EC0000-0x0000000002ED1000-memory.dmp

Download

memory/1580-76-0x0000000002EC0000-0x0000000002ED1000-memory.dmp

Download

memory/1580-57-0x0000000002EC0000-0x0000000002ED1000-memory.dmp

Download

memory/1580-92-0x0000000002EC0000-0x0000000002ED1000-memory.dmp

Download

memory/1872-30-0x0000000002310000-0x0000000002314000-memory.dmp

Download

memory/1872-18-0x0000000002D80000-0x0000000002D91000-memory.dmp

Download

memory/1872-16-0x0000000003190000-0x00000000031A1000-memory.dmp

Download

memory/1872-15-0x0000000002D80000-0x0000000002D91000-memory.dmp

Download

memory/1872-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1872-31-0x0000000002680000-0x0000000002684000-memory.dmp

Download

memory/1872-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1896-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1896-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2020-68-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download