38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837

Analysis

max time kernel
129s
max time network
147s
platform
windows10_x64
resource
win10v200430
submitted
24/06/2020, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
Size 6.1MB
Sample200624-ym8ajctmvs
SHA256 38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837
MD5 70057800e874e1e2ca6f38e4d7757a60
SHA1 40ec177296db7827c4c448fed531bac8402a7444
SHA512 9f26bb7a659708e7ccfc77f26fb4bc43578f1d4a8651fed09621e4ca8312a56a90e0366b1244dadb73266c532b03f21107d6b87ec9e36817cf8d815967d00b6a
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
4020	explorer.exe
4020	explorer.exe
3212	explorer.exe
3212	explorer.exe
3388	spoolsv.exe
3388	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
3764	spoolsv.exe
3764	spoolsv.exe
1612	spoolsv.exe
1612	spoolsv.exe
1232	spoolsv.exe
1232	spoolsv.exe
760	spoolsv.exe
760	spoolsv.exe
3952	spoolsv.exe
3952	spoolsv.exe
1760	spoolsv.exe
1760	spoolsv.exe

Suspicious use of WriteProcessMemory 306 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1240	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	68
PID 972 wrote to memory of 1240	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	68
PID 972 wrote to memory of 1240	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	68
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 972 wrote to memory of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 wrote to memory of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 1444 wrote to memory of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 1444 wrote to memory of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 1444 wrote to memory of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 1444 wrote to memory of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 2668 wrote to memory of 4020	2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	77
PID 2668 wrote to memory of 4020	2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	77
PID 2668 wrote to memory of 4020	2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	77
PID 4020 wrote to memory of 3920	4020	explorer.exe	78
PID 4020 wrote to memory of 3920	4020	explorer.exe	78
PID 4020 wrote to memory of 3920	4020	explorer.exe	78
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4020 wrote to memory of 4060	4020	explorer.exe	80
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3212	4060	explorer.exe	81
PID 4060 wrote to memory of 3340	4060	explorer.exe	82
PID 4060 wrote to memory of 3340	4060	explorer.exe	82
PID 4060 wrote to memory of 3340	4060	explorer.exe	82
PID 4060 wrote to memory of 3340	4060	explorer.exe	82
PID 4060 wrote to memory of 3340	4060	explorer.exe	82
PID 3212 wrote to memory of 3388	3212	explorer.exe	83
PID 3212 wrote to memory of 3388	3212	explorer.exe	83
PID 3212 wrote to memory of 3388	3212	explorer.exe	83
PID 3388 wrote to memory of 3420	3388	spoolsv.exe	84
PID 3388 wrote to memory of 3420	3388	spoolsv.exe	84
PID 3388 wrote to memory of 3420	3388	spoolsv.exe	84
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3388 wrote to memory of 2632	3388	spoolsv.exe	86
PID 3212 wrote to memory of 3764	3212	explorer.exe	87
PID 3212 wrote to memory of 3764	3212	explorer.exe	87
PID 3212 wrote to memory of 3764	3212	explorer.exe	87
PID 3764 wrote to memory of 1980	3764	spoolsv.exe	88
PID 3764 wrote to memory of 1980	3764	spoolsv.exe	88
PID 3764 wrote to memory of 1980	3764	spoolsv.exe	88
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3764 wrote to memory of 3800	3764	spoolsv.exe	90
PID 3212 wrote to memory of 1612	3212	explorer.exe	91
PID 3212 wrote to memory of 1612	3212	explorer.exe	91
PID 3212 wrote to memory of 1612	3212	explorer.exe	91
PID 1612 wrote to memory of 1992	1612	spoolsv.exe	92
PID 1612 wrote to memory of 1992	1612	spoolsv.exe	92
PID 1612 wrote to memory of 1992	1612	spoolsv.exe	92
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 1612 wrote to memory of 1360	1612	spoolsv.exe	94
PID 3212 wrote to memory of 1232	3212	explorer.exe	95
PID 3212 wrote to memory of 1232	3212	explorer.exe	95
PID 3212 wrote to memory of 1232	3212	explorer.exe	95
PID 1232 wrote to memory of 1488	1232	spoolsv.exe	96
PID 1232 wrote to memory of 1488	1232	spoolsv.exe	96
PID 1232 wrote to memory of 1488	1232	spoolsv.exe	96
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 1232 wrote to memory of 2208	1232	spoolsv.exe	98
PID 3212 wrote to memory of 760	3212	explorer.exe	99
PID 3212 wrote to memory of 760	3212	explorer.exe	99
PID 3212 wrote to memory of 760	3212	explorer.exe	99
PID 760 wrote to memory of 60	760	spoolsv.exe	100
PID 760 wrote to memory of 60	760	spoolsv.exe	100
PID 760 wrote to memory of 60	760	spoolsv.exe	100
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 760 wrote to memory of 3144	760	spoolsv.exe	102
PID 3212 wrote to memory of 3952	3212	explorer.exe	104
PID 3212 wrote to memory of 3952	3212	explorer.exe	104
PID 3212 wrote to memory of 3952	3212	explorer.exe	104
PID 3952 wrote to memory of 2796	3952	spoolsv.exe	105
PID 3952 wrote to memory of 2796	3952	spoolsv.exe	105
PID 3952 wrote to memory of 2796	3952	spoolsv.exe	105
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3952 wrote to memory of 1420	3952	spoolsv.exe	108
PID 3212 wrote to memory of 1760	3212	explorer.exe	109
PID 3212 wrote to memory of 1760	3212	explorer.exe	109
PID 3212 wrote to memory of 1760	3212	explorer.exe	109

Executes dropped EXE 16 IoCs

pid	Process
4020	explorer.exe
4060	explorer.exe
3212	explorer.exe
3388	spoolsv.exe
2632	spoolsv.exe
3764	spoolsv.exe
3800	spoolsv.exe
1612	spoolsv.exe
1360	spoolsv.exe
1232	spoolsv.exe
2208	spoolsv.exe
760	spoolsv.exe
3144	spoolsv.exe
3952	spoolsv.exe
1420	spoolsv.exe
1760	spoolsv.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
2668	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
4020	explorer.exe
4020	explorer.exe
3388	spoolsv.exe
3388	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3764	spoolsv.exe
3764	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
1612	spoolsv.exe
1612	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
1232	spoolsv.exe
1232	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
760	spoolsv.exe
760	spoolsv.exe
3212	explorer.exe
3212	explorer.exe
3952	spoolsv.exe
3952	spoolsv.exe
3212	explorer.exe
3212	explorer.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 1444	972	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	70
PID 1444 set thread context of 2668	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	75
PID 1444 set thread context of 2888	1444	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe	76
PID 4020 set thread context of 4060	4020	explorer.exe	80
PID 4060 set thread context of 3212	4060	explorer.exe	81
PID 4060 set thread context of 3340	4060	explorer.exe	82
PID 3388 set thread context of 2632	3388	spoolsv.exe	86
PID 3764 set thread context of 3800	3764	spoolsv.exe	90
PID 1612 set thread context of 1360	1612	spoolsv.exe	94
PID 1232 set thread context of 2208	1232	spoolsv.exe	98
PID 760 set thread context of 3144	760	spoolsv.exe	102
PID 3952 set thread context of 1420	3952	spoolsv.exe	108

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
"C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1240
- C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
  C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Adds Run entry to start application
  - Suspicious use of SetThreadContext
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
    C:\Users\Admin\AppData\Local\Temp\38e2690197334544b58b618112741d94655df46a67efe8abf1c9287bae4e8837.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: EnumeratesProcesses
    - Drops file in Windows directory
    PID:2668
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      PID:4020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:3920
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        
        PID:4060
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Adds Run entry to start application
        Modifies WinLogon for persistence
        Modifies Installed Components in the registry
        Modifies the visibility of hidden or system files
        Suspicious behavior: EnumeratesProcesses
        Drops file in Windows directory
        
        PID:3212
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:3420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2632
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1980
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1992
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1360
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2208
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:60
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3144
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2796
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetWindowsHookEx
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2524
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3340
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1444-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1444-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/2208-92-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/2632-58-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/2668-15-0x00000000033B0000-0x00000000033B1000-memory.dmp

Download

memory/2668-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-16-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

Download

memory/2888-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2888-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3144-103-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3212-50-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-64-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-108-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-53-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-76-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-75-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-86-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-87-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-109-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-98-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-97-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3212-51-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-65-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/3212-52-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/3800-70-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download