4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c

Analysis

max time kernel
130s
max time network
61s
platform
windows7_x64
resource
win7v200430
submitted
29/06/2020, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
Size 6.1MB
Sample200629-c29tca2l2a
SHA256 4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c
MD5 728b7fcf962cef138465502b55a8c65a
SHA1 6c02e7fe69d908cb934dc753728490f3200bd786
SHA512 ed5b24ae96b418e0f24740a0f8bcb9651a6bf44191a805fcb4777a0d496925e18e6140fbf325bf9b89e1e385c0d0a69a17bf53bd638fd035bbfc7133db376e5d
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 324 set thread context of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 set thread context of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 1576 set thread context of 268	1576	explorer.exe	34
PID 268 set thread context of 1920	268	explorer.exe	35
PID 268 set thread context of 1968	268	explorer.exe	36
PID 328 set thread context of 1668	328	spoolsv.exe	40
PID 2028 set thread context of 1528	2028	spoolsv.exe	44
PID 112 set thread context of 740	112	spoolsv.exe	48
PID 1196 set thread context of 1600	1196	spoolsv.exe	52

Executes dropped EXE 11 IoCs

pid	Process
1576	explorer.exe
268	explorer.exe
1920	explorer.exe
328	spoolsv.exe
1668	spoolsv.exe
2028	spoolsv.exe
1528	spoolsv.exe
112	spoolsv.exe
740	spoolsv.exe
1196	spoolsv.exe
1600	spoolsv.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1576	explorer.exe
1576	explorer.exe
1920	explorer.exe
1920	explorer.exe
328	spoolsv.exe
328	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
2028	spoolsv.exe
2028	spoolsv.exe
112	spoolsv.exe
112	spoolsv.exe
1196	spoolsv.exe
1196	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1576	explorer.exe
328	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
2028	spoolsv.exe
1920	explorer.exe
112	spoolsv.exe
1920	explorer.exe
1196	spoolsv.exe
1920	explorer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1872-18-0x0000000002CB0000-0x0000000002CC1000-memory.dmp	upx

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Suspicious use of WriteProcessMemory 216 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1424	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	24
PID 1388 wrote to memory of 1424	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	24
PID 1388 wrote to memory of 1424	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	24
PID 1388 wrote to memory of 1424	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	24
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 1388 wrote to memory of 324	1388	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	26
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1872	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	29
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 324 wrote to memory of 1776	324	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	30
PID 1872 wrote to memory of 1576	1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	31
PID 1872 wrote to memory of 1576	1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	31
PID 1872 wrote to memory of 1576	1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	31
PID 1872 wrote to memory of 1576	1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	31
PID 1576 wrote to memory of 1636	1576	explorer.exe	32
PID 1576 wrote to memory of 1636	1576	explorer.exe	32
PID 1576 wrote to memory of 1636	1576	explorer.exe	32
PID 1576 wrote to memory of 1636	1576	explorer.exe	32
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 1576 wrote to memory of 268	1576	explorer.exe	34
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1920	268	explorer.exe	35
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 268 wrote to memory of 1968	268	explorer.exe	36
PID 1920 wrote to memory of 328	1920	explorer.exe	37
PID 1920 wrote to memory of 328	1920	explorer.exe	37
PID 1920 wrote to memory of 328	1920	explorer.exe	37
PID 1920 wrote to memory of 328	1920	explorer.exe	37
PID 328 wrote to memory of 1516	328	spoolsv.exe	38
PID 328 wrote to memory of 1516	328	spoolsv.exe	38
PID 328 wrote to memory of 1516	328	spoolsv.exe	38
PID 328 wrote to memory of 1516	328	spoolsv.exe	38
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 328 wrote to memory of 1668	328	spoolsv.exe	40
PID 1920 wrote to memory of 2028	1920	explorer.exe	41
PID 1920 wrote to memory of 2028	1920	explorer.exe	41
PID 1920 wrote to memory of 2028	1920	explorer.exe	41
PID 1920 wrote to memory of 2028	1920	explorer.exe	41
PID 2028 wrote to memory of 1448	2028	spoolsv.exe	42
PID 2028 wrote to memory of 1448	2028	spoolsv.exe	42
PID 2028 wrote to memory of 1448	2028	spoolsv.exe	42
PID 2028 wrote to memory of 1448	2028	spoolsv.exe	42
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 2028 wrote to memory of 1528	2028	spoolsv.exe	44
PID 1920 wrote to memory of 112	1920	explorer.exe	45
PID 1920 wrote to memory of 112	1920	explorer.exe	45
PID 1920 wrote to memory of 112	1920	explorer.exe	45
PID 1920 wrote to memory of 112	1920	explorer.exe	45
PID 112 wrote to memory of 1752	112	spoolsv.exe	46
PID 112 wrote to memory of 1752	112	spoolsv.exe	46
PID 112 wrote to memory of 1752	112	spoolsv.exe	46
PID 112 wrote to memory of 1752	112	spoolsv.exe	46
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 112 wrote to memory of 740	112	spoolsv.exe	48
PID 1920 wrote to memory of 1196	1920	explorer.exe	49
PID 1920 wrote to memory of 1196	1920	explorer.exe	49
PID 1920 wrote to memory of 1196	1920	explorer.exe	49
PID 1920 wrote to memory of 1196	1920	explorer.exe	49
PID 1196 wrote to memory of 1844	1196	spoolsv.exe	50
PID 1196 wrote to memory of 1844	1196	spoolsv.exe	50
PID 1196 wrote to memory of 1844	1196	spoolsv.exe	50
PID 1196 wrote to memory of 1844	1196	spoolsv.exe	50
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1196 wrote to memory of 1600	1196	spoolsv.exe	52
PID 1920 wrote to memory of 1572	1920	explorer.exe	53
PID 1920 wrote to memory of 1572	1920	explorer.exe	53
PID 1920 wrote to memory of 1572	1920	explorer.exe	53
PID 1920 wrote to memory of 1572	1920	explorer.exe	53

Loads dropped DLL 16 IoCs

pid	Process
1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1872	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
1920	explorer.exe
1920	explorer.exe
328	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
2028	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
112	spoolsv.exe
1920	explorer.exe
1920	explorer.exe
1196	spoolsv.exe
1920	explorer.exe
1920	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
"C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
  C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
    C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious behavior: EnumeratesProcesses
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    - Loads dropped DLL
    PID:1872
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious behavior: EnumeratesProcesses
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1636
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Adds Run entry to start application
        
        PID:268
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Modifies Installed Components in the registry
        Modifies the visibility of hidden or system files
        Adds Run entry to start application
        Drops file in Windows directory
        Loads dropped DLL
        Modifies WinLogon for persistence
        
        PID:1920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Drops file in Windows directory
        Loads dropped DLL
        
        PID:328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1668
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Drops file in Windows directory
        Loads dropped DLL
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1528
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Drops file in Windows directory
        Loads dropped DLL
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1752
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:740
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Drops file in Windows directory
        Loads dropped DLL
        
        PID:1196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1844
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1600
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        
        PID:1572
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1968
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-33-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/324-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/324-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/324-3-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1528-85-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1668-69-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1776-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1776-8-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1872-15-0x0000000002CB0000-0x0000000002CC1000-memory.dmp

Download

memory/1872-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1872-16-0x00000000030C0000-0x00000000030D1000-memory.dmp

Download

memory/1872-18-0x0000000002CB0000-0x0000000002CC1000-memory.dmp

Download

memory/1872-10-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1872-31-0x00000000004B0000-0x00000000004B4000-memory.dmp

Download

memory/1872-32-0x00000000025E0000-0x00000000025E4000-memory.dmp

Download

memory/1920-60-0x0000000003330000-0x0000000003341000-memory.dmp

Download

memory/1920-62-0x0000000003330000-0x0000000003341000-memory.dmp

Download

memory/1920-93-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1920-78-0x0000000003330000-0x0000000003341000-memory.dmp

Download

memory/1920-77-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1920-64-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1920-94-0x0000000003330000-0x0000000003341000-memory.dmp

Download

memory/1920-61-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1920-109-0x0000000003330000-0x0000000003341000-memory.dmp

Download

memory/1920-58-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download

memory/1920-108-0x0000000002F20000-0x0000000002F31000-memory.dmp

Download