4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c

Analysis

max time kernel
149s
max time network
124s
platform
windows10_x64
resource
win10
submitted
29/06/2020, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
Size 6.1MB
Sample200629-c29tca2l2a
SHA256 4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c
MD5 728b7fcf962cef138465502b55a8c65a
SHA1 6c02e7fe69d908cb934dc753728490f3200bd786
SHA512 ed5b24ae96b418e0f24740a0f8bcb9651a6bf44191a805fcb4777a0d496925e18e6140fbf325bf9b89e1e385c0d0a69a17bf53bd638fd035bbfc7133db376e5d
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of WriteProcessMemory 377 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3836	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	67
PID 3068 wrote to memory of 3836	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	67
PID 3068 wrote to memory of 3836	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	67
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3068 wrote to memory of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 3828 wrote to memory of 3848	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	73
PID 3828 wrote to memory of 3848	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	73
PID 3828 wrote to memory of 3848	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	73
PID 3732 wrote to memory of 572	3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	74
PID 3732 wrote to memory of 572	3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	74
PID 3732 wrote to memory of 572	3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	74
PID 572 wrote to memory of 3688	572	explorer.exe	75
PID 572 wrote to memory of 3688	572	explorer.exe	75
PID 572 wrote to memory of 3688	572	explorer.exe	75
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 572 wrote to memory of 3812	572	explorer.exe	77
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1508	3812	explorer.exe	82
PID 3812 wrote to memory of 1780	3812	explorer.exe	83
PID 3812 wrote to memory of 1780	3812	explorer.exe	83
PID 3812 wrote to memory of 1780	3812	explorer.exe	83
PID 3812 wrote to memory of 1780	3812	explorer.exe	83
PID 3812 wrote to memory of 1780	3812	explorer.exe	83
PID 1508 wrote to memory of 2088	1508	explorer.exe	84
PID 1508 wrote to memory of 2088	1508	explorer.exe	84
PID 1508 wrote to memory of 2088	1508	explorer.exe	84
PID 2088 wrote to memory of 2156	2088	spoolsv.exe	85
PID 2088 wrote to memory of 2156	2088	spoolsv.exe	85
PID 2088 wrote to memory of 2156	2088	spoolsv.exe	85
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 2088 wrote to memory of 2536	2088	spoolsv.exe	87
PID 1508 wrote to memory of 3860	1508	explorer.exe	88
PID 1508 wrote to memory of 3860	1508	explorer.exe	88
PID 1508 wrote to memory of 3860	1508	explorer.exe	88
PID 3860 wrote to memory of 2804	3860	spoolsv.exe	89
PID 3860 wrote to memory of 2804	3860	spoolsv.exe	89
PID 3860 wrote to memory of 2804	3860	spoolsv.exe	89
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 3860 wrote to memory of 4048	3860	spoolsv.exe	91
PID 1508 wrote to memory of 3604	1508	explorer.exe	92
PID 1508 wrote to memory of 3604	1508	explorer.exe	92
PID 1508 wrote to memory of 3604	1508	explorer.exe	92
PID 3604 wrote to memory of 4008	3604	spoolsv.exe	93
PID 3604 wrote to memory of 4008	3604	spoolsv.exe	93
PID 3604 wrote to memory of 4008	3604	spoolsv.exe	93
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 3604 wrote to memory of 4072	3604	spoolsv.exe	95
PID 1508 wrote to memory of 3520	1508	explorer.exe	96
PID 1508 wrote to memory of 3520	1508	explorer.exe	96
PID 1508 wrote to memory of 3520	1508	explorer.exe	96
PID 3520 wrote to memory of 3828	3520	spoolsv.exe	97
PID 3520 wrote to memory of 3828	3520	spoolsv.exe	97
PID 3520 wrote to memory of 3828	3520	spoolsv.exe	97
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 3520 wrote to memory of 3004	3520	spoolsv.exe	99
PID 1508 wrote to memory of 2308	1508	explorer.exe	100
PID 1508 wrote to memory of 2308	1508	explorer.exe	100
PID 1508 wrote to memory of 2308	1508	explorer.exe	100
PID 2308 wrote to memory of 572	2308	spoolsv.exe	101
PID 2308 wrote to memory of 572	2308	spoolsv.exe	101
PID 2308 wrote to memory of 572	2308	spoolsv.exe	101
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 2308 wrote to memory of 3056	2308	spoolsv.exe	103
PID 1508 wrote to memory of 1008	1508	explorer.exe	104
PID 1508 wrote to memory of 1008	1508	explorer.exe	104
PID 1508 wrote to memory of 1008	1508	explorer.exe	104
PID 1008 wrote to memory of 1540	1008	spoolsv.exe	105
PID 1008 wrote to memory of 1540	1008	spoolsv.exe	105
PID 1008 wrote to memory of 1540	1008	spoolsv.exe	105
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1008 wrote to memory of 3856	1008	spoolsv.exe	107
PID 1508 wrote to memory of 1432	1508	explorer.exe	108
PID 1508 wrote to memory of 1432	1508	explorer.exe	108
PID 1508 wrote to memory of 1432	1508	explorer.exe	108
PID 1432 wrote to memory of 1228	1432	spoolsv.exe	109
PID 1432 wrote to memory of 1228	1432	spoolsv.exe	109
PID 1432 wrote to memory of 1228	1432	spoolsv.exe	109
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1432 wrote to memory of 3200	1432	spoolsv.exe	111
PID 1508 wrote to memory of 1636	1508	explorer.exe	112
PID 1508 wrote to memory of 1636	1508	explorer.exe	112
PID 1508 wrote to memory of 1636	1508	explorer.exe	112
PID 1636 wrote to memory of 2148	1636	spoolsv.exe	113
PID 1636 wrote to memory of 2148	1636	spoolsv.exe	113
PID 1636 wrote to memory of 2148	1636	spoolsv.exe	113
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1636 wrote to memory of 2684	1636	spoolsv.exe	115
PID 1508 wrote to memory of 2624	1508	explorer.exe	116
PID 1508 wrote to memory of 2624	1508	explorer.exe	116
PID 1508 wrote to memory of 2624	1508	explorer.exe	116
PID 2624 wrote to memory of 68	2624	spoolsv.exe	117
PID 2624 wrote to memory of 68	2624	spoolsv.exe	117
PID 2624 wrote to memory of 68	2624	spoolsv.exe	117

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
572	explorer.exe
572	explorer.exe
2088	spoolsv.exe
2088	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
1508	explorer.exe
3860	spoolsv.exe
3860	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
3604	spoolsv.exe
3604	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
3520	spoolsv.exe
3520	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
2308	spoolsv.exe
2308	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
1008	spoolsv.exe
1008	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
1432	spoolsv.exe
1432	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
1636	spoolsv.exe
1636	spoolsv.exe
1508	explorer.exe
1508	explorer.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3828	3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	69
PID 3828 set thread context of 3732	3828	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe	72
PID 572 set thread context of 3812	572	explorer.exe	77
PID 3812 set thread context of 1508	3812	explorer.exe	82
PID 3812 set thread context of 1780	3812	explorer.exe	83
PID 2088 set thread context of 2536	2088	spoolsv.exe	87
PID 3860 set thread context of 4048	3860	spoolsv.exe	91
PID 3604 set thread context of 4072	3604	spoolsv.exe	95
PID 3520 set thread context of 3004	3520	spoolsv.exe	99
PID 2308 set thread context of 3056	2308	spoolsv.exe	103
PID 1008 set thread context of 3856	1008	spoolsv.exe	107
PID 1432 set thread context of 3200	1432	spoolsv.exe	111
PID 1636 set thread context of 2684	1636	spoolsv.exe	115

Executes dropped EXE 20 IoCs

pid	Process
572	explorer.exe
3812	explorer.exe
1508	explorer.exe
2088	spoolsv.exe
2536	spoolsv.exe
3860	spoolsv.exe
4048	spoolsv.exe
3604	spoolsv.exe
4072	spoolsv.exe
3520	spoolsv.exe
3004	spoolsv.exe
2308	spoolsv.exe
3056	spoolsv.exe
1008	spoolsv.exe
3856	spoolsv.exe
1432	spoolsv.exe
3200	spoolsv.exe
1636	spoolsv.exe
2684	spoolsv.exe
2624	spoolsv.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3068	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
3732	4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
572	explorer.exe
572	explorer.exe
1508	explorer.exe
1508	explorer.exe
2088	spoolsv.exe
2088	spoolsv.exe
1508	explorer.exe
1508	explorer.exe
3860	spoolsv.exe
3860	spoolsv.exe
3604	spoolsv.exe
3604	spoolsv.exe
3520	spoolsv.exe
3520	spoolsv.exe
2308	spoolsv.exe
2308	spoolsv.exe
1008	spoolsv.exe
1008	spoolsv.exe
1432	spoolsv.exe
1432	spoolsv.exe
1636	spoolsv.exe
1636	spoolsv.exe
2624	spoolsv.exe
2624	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
"C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
  C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
  2⤵
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:3828
- - C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
    C:\Users\Admin\AppData\Local\Temp\4567d8265b3dec803dfa668da8045b70df22802447b48f385fc4eab009648c4c.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: EnumeratesProcesses
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3732
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:572
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        
        PID:3688
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:3812
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies Installed Components in the registry
        Adds Run entry to start application
        Suspicious behavior: EnumeratesProcesses
        Executes dropped EXE
        Modifies the visibility of hidden or system files
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2156
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2536
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2804
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:4048
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:4008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:4072
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:3828
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:572
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1540
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3200
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2148
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2684
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:68
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1780
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-115-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-46-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-47-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-48-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-91-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-92-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-126-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-81-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-79-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-45-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-70-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-58-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-59-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-69-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-114-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-125-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1508-103-0x0000000003C10000-0x0000000003C11000-memory.dmp

Download

memory/1508-102-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1780-30-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1780-33-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2536-52-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3056-96-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3732-12-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/3732-13-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/3732-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3812-23-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3828-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3828-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/3828-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/4048-64-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/4072-74-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download