57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717

Analysis

max time kernel
109s
max time network
76s
platform
windows10_x64
resource
win10
submitted
29/06/2020, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
Size 1.8MB
Sample200629-e8pm4k4cx2
SHA256 57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717
MD5 2dbbe1a3dae461e1616d37c91a1b0e2f
SHA1 76b407be6ad6a4ec4ae71cdc4440e3d51b28cd9b
SHA512 d4b7fe4b68f9caf93ee98507f1018226b05a5891314ea2000b6116024e1d3847a298b3c0f2fca09dea0ff05a3b89f1cb567d91dd8d11d5c86f827596932b18a8
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 303 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3828 wrote to memory of 3936	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	68
PID 3828 wrote to memory of 3936	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	68
PID 3828 wrote to memory of 3936	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	68
PID 3852 wrote to memory of 3892	3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	69
PID 3852 wrote to memory of 3892	3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	69
PID 3852 wrote to memory of 3892	3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	69
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 396	3892	explorer.exe	76
PID 3892 wrote to memory of 1152	3892	explorer.exe	77
PID 3892 wrote to memory of 1152	3892	explorer.exe	77
PID 3892 wrote to memory of 1152	3892	explorer.exe	77
PID 3892 wrote to memory of 1152	3892	explorer.exe	77
PID 3892 wrote to memory of 1152	3892	explorer.exe	77
PID 396 wrote to memory of 1468	396	explorer.exe	78
PID 396 wrote to memory of 1468	396	explorer.exe	78
PID 396 wrote to memory of 1468	396	explorer.exe	78
PID 396 wrote to memory of 1740	396	explorer.exe	79
PID 396 wrote to memory of 1740	396	explorer.exe	79
PID 396 wrote to memory of 1740	396	explorer.exe	79
PID 396 wrote to memory of 1912	396	explorer.exe	80
PID 396 wrote to memory of 1912	396	explorer.exe	80
PID 396 wrote to memory of 1912	396	explorer.exe	80
PID 396 wrote to memory of 3888	396	explorer.exe	81
PID 396 wrote to memory of 3888	396	explorer.exe	81
PID 396 wrote to memory of 3888	396	explorer.exe	81
PID 396 wrote to memory of 3756	396	explorer.exe	82
PID 396 wrote to memory of 3756	396	explorer.exe	82
PID 396 wrote to memory of 3756	396	explorer.exe	82
PID 396 wrote to memory of 2096	396	explorer.exe	83
PID 396 wrote to memory of 2096	396	explorer.exe	83
PID 396 wrote to memory of 2096	396	explorer.exe	83
PID 396 wrote to memory of 2180	396	explorer.exe	84
PID 396 wrote to memory of 2180	396	explorer.exe	84
PID 396 wrote to memory of 2180	396	explorer.exe	84
PID 396 wrote to memory of 2704	396	explorer.exe	85
PID 396 wrote to memory of 2704	396	explorer.exe	85
PID 396 wrote to memory of 2704	396	explorer.exe	85
PID 396 wrote to memory of 2988	396	explorer.exe	86
PID 396 wrote to memory of 2988	396	explorer.exe	86
PID 396 wrote to memory of 2988	396	explorer.exe	86
PID 396 wrote to memory of 3636	396	explorer.exe	87
PID 396 wrote to memory of 3636	396	explorer.exe	87
PID 396 wrote to memory of 3636	396	explorer.exe	87
PID 396 wrote to memory of 3196	396	explorer.exe	88
PID 396 wrote to memory of 3196	396	explorer.exe	88
PID 396 wrote to memory of 3196	396	explorer.exe	88
PID 396 wrote to memory of 2528	396	explorer.exe	89
PID 396 wrote to memory of 2528	396	explorer.exe	89
PID 396 wrote to memory of 2528	396	explorer.exe	89
PID 396 wrote to memory of 2580	396	explorer.exe	90
PID 396 wrote to memory of 2580	396	explorer.exe	90
PID 396 wrote to memory of 2580	396	explorer.exe	90
PID 396 wrote to memory of 3828	396	explorer.exe	91
PID 396 wrote to memory of 3828	396	explorer.exe	91
PID 396 wrote to memory of 3828	396	explorer.exe	91
PID 396 wrote to memory of 3916	396	explorer.exe	92
PID 396 wrote to memory of 3916	396	explorer.exe	92
PID 396 wrote to memory of 3916	396	explorer.exe	92
PID 396 wrote to memory of 580	396	explorer.exe	93
PID 396 wrote to memory of 580	396	explorer.exe	93
PID 396 wrote to memory of 580	396	explorer.exe	93
PID 396 wrote to memory of 1272	396	explorer.exe	94
PID 396 wrote to memory of 1272	396	explorer.exe	94
PID 396 wrote to memory of 1272	396	explorer.exe	94
PID 396 wrote to memory of 2824	396	explorer.exe	95
PID 396 wrote to memory of 2824	396	explorer.exe	95
PID 396 wrote to memory of 2824	396	explorer.exe	95
PID 396 wrote to memory of 2476	396	explorer.exe	96
PID 396 wrote to memory of 2476	396	explorer.exe	96
PID 396 wrote to memory of 2476	396	explorer.exe	96
PID 396 wrote to memory of 1568	396	explorer.exe	97
PID 396 wrote to memory of 1568	396	explorer.exe	97
PID 396 wrote to memory of 1568	396	explorer.exe	97
PID 396 wrote to memory of 1908	396	explorer.exe	98
PID 396 wrote to memory of 1908	396	explorer.exe	98
PID 396 wrote to memory of 1908	396	explorer.exe	98
PID 396 wrote to memory of 912	396	explorer.exe	99
PID 396 wrote to memory of 912	396	explorer.exe	99
PID 396 wrote to memory of 912	396	explorer.exe	99
PID 396 wrote to memory of 2116	396	explorer.exe	100
PID 396 wrote to memory of 2116	396	explorer.exe	100
PID 396 wrote to memory of 2116	396	explorer.exe	100
PID 396 wrote to memory of 1168	396	explorer.exe	101
PID 396 wrote to memory of 1168	396	explorer.exe	101
PID 396 wrote to memory of 1168	396	explorer.exe	101
PID 396 wrote to memory of 1200	396	explorer.exe	102
PID 396 wrote to memory of 1200	396	explorer.exe	102
PID 396 wrote to memory of 1200	396	explorer.exe	102
PID 396 wrote to memory of 1500	396	explorer.exe	103
PID 396 wrote to memory of 1500	396	explorer.exe	103
PID 396 wrote to memory of 1500	396	explorer.exe	103
PID 396 wrote to memory of 1876	396	explorer.exe	104
PID 396 wrote to memory of 1876	396	explorer.exe	104
PID 396 wrote to memory of 1876	396	explorer.exe	104
PID 396 wrote to memory of 3732	396	explorer.exe	105
PID 396 wrote to memory of 3732	396	explorer.exe	105
PID 396 wrote to memory of 3732	396	explorer.exe	105
PID 396 wrote to memory of 2172	396	explorer.exe	106
PID 396 wrote to memory of 2172	396	explorer.exe	106
PID 396 wrote to memory of 2172	396	explorer.exe	106
PID 396 wrote to memory of 2780	396	explorer.exe	107
PID 396 wrote to memory of 2780	396	explorer.exe	107
PID 396 wrote to memory of 2780	396	explorer.exe	107
PID 396 wrote to memory of 4084	396	explorer.exe	108
PID 396 wrote to memory of 4084	396	explorer.exe	108
PID 396 wrote to memory of 4084	396	explorer.exe	108
PID 396 wrote to memory of 2492	396	explorer.exe	109
PID 396 wrote to memory of 2492	396	explorer.exe	109
PID 396 wrote to memory of 2492	396	explorer.exe	109
PID 396 wrote to memory of 3940	396	explorer.exe	110
PID 396 wrote to memory of 3940	396	explorer.exe	110
PID 396 wrote to memory of 3940	396	explorer.exe	110
PID 396 wrote to memory of 3968	396	explorer.exe	111
PID 396 wrote to memory of 3968	396	explorer.exe	111
PID 396 wrote to memory of 3968	396	explorer.exe	111
PID 396 wrote to memory of 408	396	explorer.exe	112
PID 396 wrote to memory of 408	396	explorer.exe	112
PID 396 wrote to memory of 408	396	explorer.exe	112
PID 396 wrote to memory of 3312	396	explorer.exe	113
PID 396 wrote to memory of 3312	396	explorer.exe	113
PID 396 wrote to memory of 3312	396	explorer.exe	113
PID 396 wrote to memory of 2056	396	explorer.exe	114
PID 396 wrote to memory of 2056	396	explorer.exe	114
PID 396 wrote to memory of 2056	396	explorer.exe	114
PID 396 wrote to memory of 4028	396	explorer.exe	115
PID 396 wrote to memory of 4028	396	explorer.exe	115
PID 396 wrote to memory of 4028	396	explorer.exe	115
PID 396 wrote to memory of 1632	396	explorer.exe	116
PID 396 wrote to memory of 1632	396	explorer.exe	116
PID 396 wrote to memory of 1632	396	explorer.exe	116
PID 396 wrote to memory of 2128	396	explorer.exe	117
PID 396 wrote to memory of 2128	396	explorer.exe	117
PID 396 wrote to memory of 2128	396	explorer.exe	117
PID 396 wrote to memory of 2980	396	explorer.exe	118
PID 396 wrote to memory of 2980	396	explorer.exe	118
PID 396 wrote to memory of 2980	396	explorer.exe	118
PID 396 wrote to memory of 3480	396	explorer.exe	119
PID 396 wrote to memory of 3480	396	explorer.exe	119
PID 396 wrote to memory of 3480	396	explorer.exe	119
PID 396 wrote to memory of 1232	396	explorer.exe	120
PID 396 wrote to memory of 1232	396	explorer.exe	120
PID 396 wrote to memory of 1232	396	explorer.exe	120
PID 396 wrote to memory of 1296	396	explorer.exe	121
PID 396 wrote to memory of 1296	396	explorer.exe	121
PID 396 wrote to memory of 1296	396	explorer.exe	121
PID 396 wrote to memory of 3704	396	explorer.exe	122
PID 396 wrote to memory of 3704	396	explorer.exe	122
PID 396 wrote to memory of 3704	396	explorer.exe	122
PID 396 wrote to memory of 1028	396	explorer.exe	123
PID 396 wrote to memory of 1028	396	explorer.exe	123
PID 396 wrote to memory of 1028	396	explorer.exe	123
PID 396 wrote to memory of 852	396	explorer.exe	124
PID 396 wrote to memory of 852	396	explorer.exe	124
PID 396 wrote to memory of 852	396	explorer.exe	124
PID 396 wrote to memory of 2776	396	explorer.exe	125
PID 396 wrote to memory of 2776	396	explorer.exe	125
PID 396 wrote to memory of 2776	396	explorer.exe	125
PID 396 wrote to memory of 3816	396	explorer.exe	126
PID 396 wrote to memory of 3816	396	explorer.exe	126
PID 396 wrote to memory of 3816	396	explorer.exe	126
PID 396 wrote to memory of 4132	396	explorer.exe	127
PID 396 wrote to memory of 4132	396	explorer.exe	127
PID 396 wrote to memory of 4132	396	explorer.exe	127
PID 396 wrote to memory of 4164	396	explorer.exe	128
PID 396 wrote to memory of 4164	396	explorer.exe	128
PID 396 wrote to memory of 4164	396	explorer.exe	128
PID 396 wrote to memory of 4196	396	explorer.exe	129
PID 396 wrote to memory of 4196	396	explorer.exe	129
PID 396 wrote to memory of 4196	396	explorer.exe	129
PID 396 wrote to memory of 4228	396	explorer.exe	130
PID 396 wrote to memory of 4228	396	explorer.exe	130
PID 396 wrote to memory of 4228	396	explorer.exe	130
PID 396 wrote to memory of 4260	396	explorer.exe	131
PID 396 wrote to memory of 4260	396	explorer.exe	131
PID 396 wrote to memory of 4260	396	explorer.exe	131
PID 396 wrote to memory of 4292	396	explorer.exe	132
PID 396 wrote to memory of 4292	396	explorer.exe	132
PID 396 wrote to memory of 4292	396	explorer.exe	132
PID 396 wrote to memory of 4324	396	explorer.exe	133
PID 396 wrote to memory of 4324	396	explorer.exe	133
PID 396 wrote to memory of 4324	396	explorer.exe	133
PID 396 wrote to memory of 4356	396	explorer.exe	134
PID 396 wrote to memory of 4356	396	explorer.exe	134
PID 396 wrote to memory of 4356	396	explorer.exe	134
PID 396 wrote to memory of 4388	396	explorer.exe	135
PID 396 wrote to memory of 4388	396	explorer.exe	135
PID 396 wrote to memory of 4388	396	explorer.exe	135
PID 396 wrote to memory of 4420	396	explorer.exe	136
PID 396 wrote to memory of 4420	396	explorer.exe	136
PID 396 wrote to memory of 4420	396	explorer.exe	136
PID 396 wrote to memory of 4452	396	explorer.exe	137
PID 396 wrote to memory of 4452	396	explorer.exe	137
PID 396 wrote to memory of 4452	396	explorer.exe	137
PID 396 wrote to memory of 4484	396	explorer.exe	138
PID 396 wrote to memory of 4484	396	explorer.exe	138
PID 396 wrote to memory of 4484	396	explorer.exe	138
PID 396 wrote to memory of 4516	396	explorer.exe	139
PID 396 wrote to memory of 4516	396	explorer.exe	139
PID 396 wrote to memory of 4516	396	explorer.exe	139
PID 396 wrote to memory of 4548	396	explorer.exe	140
PID 396 wrote to memory of 4548	396	explorer.exe	140
PID 396 wrote to memory of 4548	396	explorer.exe	140
PID 396 wrote to memory of 4580	396	explorer.exe	141
PID 396 wrote to memory of 4580	396	explorer.exe	141
PID 396 wrote to memory of 4580	396	explorer.exe	141
PID 396 wrote to memory of 4612	396	explorer.exe	142
PID 396 wrote to memory of 4612	396	explorer.exe	142
PID 396 wrote to memory of 4612	396	explorer.exe	142
PID 396 wrote to memory of 4644	396	explorer.exe	143
PID 396 wrote to memory of 4644	396	explorer.exe	143
PID 396 wrote to memory of 4644	396	explorer.exe	143
PID 396 wrote to memory of 4676	396	explorer.exe	144
PID 396 wrote to memory of 4676	396	explorer.exe	144
PID 396 wrote to memory of 4676	396	explorer.exe	144
PID 396 wrote to memory of 4708	396	explorer.exe	145
PID 396 wrote to memory of 4708	396	explorer.exe	145
PID 396 wrote to memory of 4708	396	explorer.exe	145
PID 396 wrote to memory of 4740	396	explorer.exe	146
PID 396 wrote to memory of 4740	396	explorer.exe	146
PID 396 wrote to memory of 4740	396	explorer.exe	146
PID 396 wrote to memory of 4772	396	explorer.exe	147
PID 396 wrote to memory of 4772	396	explorer.exe	147
PID 396 wrote to memory of 4772	396	explorer.exe	147
PID 396 wrote to memory of 4804	396	explorer.exe	148
PID 396 wrote to memory of 4804	396	explorer.exe	148
PID 396 wrote to memory of 4804	396	explorer.exe	148
PID 396 wrote to memory of 4836	396	explorer.exe	149
PID 396 wrote to memory of 4836	396	explorer.exe	149
PID 396 wrote to memory of 4836	396	explorer.exe	149
PID 396 wrote to memory of 4868	396	explorer.exe	150
PID 396 wrote to memory of 4868	396	explorer.exe	150
PID 396 wrote to memory of 4868	396	explorer.exe	150
PID 396 wrote to memory of 4900	396	explorer.exe	151
PID 396 wrote to memory of 4900	396	explorer.exe	151
PID 396 wrote to memory of 4900	396	explorer.exe	151
PID 396 wrote to memory of 4932	396	explorer.exe	152
PID 396 wrote to memory of 4932	396	explorer.exe	152
PID 396 wrote to memory of 4932	396	explorer.exe	152
PID 396 wrote to memory of 4964	396	explorer.exe	153
PID 396 wrote to memory of 4964	396	explorer.exe	153
PID 396 wrote to memory of 4964	396	explorer.exe	153
PID 396 wrote to memory of 4996	396	explorer.exe	154
PID 396 wrote to memory of 4996	396	explorer.exe	154
PID 396 wrote to memory of 4996	396	explorer.exe	154
PID 396 wrote to memory of 5028	396	explorer.exe	155
PID 396 wrote to memory of 5028	396	explorer.exe	155
PID 396 wrote to memory of 5028	396	explorer.exe	155
PID 396 wrote to memory of 5060	396	explorer.exe	156
PID 396 wrote to memory of 5060	396	explorer.exe	156
PID 396 wrote to memory of 5060	396	explorer.exe	156
PID 396 wrote to memory of 5092	396	explorer.exe	157
PID 396 wrote to memory of 5092	396	explorer.exe	157
PID 396 wrote to memory of 5092	396	explorer.exe	157
PID 396 wrote to memory of 4104	396	explorer.exe	158
PID 396 wrote to memory of 4104	396	explorer.exe	158
PID 396 wrote to memory of 4104	396	explorer.exe	158
PID 396 wrote to memory of 4192	396	explorer.exe	159
PID 396 wrote to memory of 4192	396	explorer.exe	159
PID 396 wrote to memory of 4192	396	explorer.exe	159
PID 396 wrote to memory of 4252	396	explorer.exe	160
PID 396 wrote to memory of 4252	396	explorer.exe	160
PID 396 wrote to memory of 4252	396	explorer.exe	160
PID 396 wrote to memory of 4316	396	explorer.exe	161
PID 396 wrote to memory of 4316	396	explorer.exe	161
PID 396 wrote to memory of 4316	396	explorer.exe	161
PID 396 wrote to memory of 4396	396	explorer.exe	162
PID 396 wrote to memory of 4396	396	explorer.exe	162
PID 396 wrote to memory of 4396	396	explorer.exe	162
PID 396 wrote to memory of 4476	396	explorer.exe	163
PID 396 wrote to memory of 4476	396	explorer.exe	163
PID 396 wrote to memory of 4476	396	explorer.exe	163
PID 396 wrote to memory of 4544	396	explorer.exe	164
PID 396 wrote to memory of 4544	396	explorer.exe	164
PID 396 wrote to memory of 4544	396	explorer.exe	164
PID 396 wrote to memory of 4620	396	explorer.exe	165
PID 396 wrote to memory of 4620	396	explorer.exe	165
PID 396 wrote to memory of 4620	396	explorer.exe	165
PID 396 wrote to memory of 4700	396	explorer.exe	166
PID 396 wrote to memory of 4700	396	explorer.exe	166
PID 396 wrote to memory of 4700	396	explorer.exe	166
PID 396 wrote to memory of 4764	396	explorer.exe	167
PID 396 wrote to memory of 4764	396	explorer.exe	167
PID 396 wrote to memory of 4764	396	explorer.exe	167
PID 396 wrote to memory of 4844	396	explorer.exe	168
PID 396 wrote to memory of 4844	396	explorer.exe	168
PID 396 wrote to memory of 4844	396	explorer.exe	168
PID 396 wrote to memory of 4908	396	explorer.exe	169
PID 396 wrote to memory of 4908	396	explorer.exe	169
PID 396 wrote to memory of 4908	396	explorer.exe	169

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3852	3828	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe	67
PID 3892 set thread context of 396	3892	explorer.exe	76
PID 3892 set thread context of 1152	3892	explorer.exe	77

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Suspicious behavior: EnumeratesProcesses 186 IoCs

pid	Process
3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
3852	57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe
396	explorer.exe

Executes dropped EXE 94 IoCs

pid	Process
3892	explorer.exe
396	explorer.exe
1468	spoolsv.exe
1740	spoolsv.exe
1912	spoolsv.exe
3888	spoolsv.exe
3756	spoolsv.exe
2096	spoolsv.exe
2180	spoolsv.exe
2704	spoolsv.exe
2988	spoolsv.exe
3636	spoolsv.exe
3196	spoolsv.exe
2528	spoolsv.exe
2580	spoolsv.exe
3828	spoolsv.exe
3916	spoolsv.exe
580	spoolsv.exe
1272	spoolsv.exe
2824	spoolsv.exe
2476	spoolsv.exe
1568	spoolsv.exe
1908	spoolsv.exe
912	spoolsv.exe
2116	spoolsv.exe
1168	spoolsv.exe
1200	spoolsv.exe
1500	spoolsv.exe
1876	spoolsv.exe
3732	spoolsv.exe
2172	spoolsv.exe
2780	spoolsv.exe
4084	spoolsv.exe
2492	spoolsv.exe
3940	spoolsv.exe
3968	spoolsv.exe
408	spoolsv.exe
3312	spoolsv.exe
2056	spoolsv.exe
4028	spoolsv.exe
1632	spoolsv.exe
2128	spoolsv.exe
2980	spoolsv.exe
3480	spoolsv.exe
1232	spoolsv.exe
1296	spoolsv.exe
3704	spoolsv.exe
1028	spoolsv.exe
852	spoolsv.exe
2776	spoolsv.exe
3816	spoolsv.exe
4132	spoolsv.exe
4164	spoolsv.exe
4196	spoolsv.exe
4228	spoolsv.exe
4260	spoolsv.exe
4292	spoolsv.exe
4324	spoolsv.exe
4356	spoolsv.exe
4388	spoolsv.exe
4420	spoolsv.exe
4452	spoolsv.exe
4484	spoolsv.exe
4516	spoolsv.exe
4548	spoolsv.exe
4580	spoolsv.exe
4612	spoolsv.exe
4644	spoolsv.exe
4676	spoolsv.exe
4708	spoolsv.exe
4740	spoolsv.exe
4772	spoolsv.exe
4804	spoolsv.exe
4836	spoolsv.exe
4868	spoolsv.exe
4900	spoolsv.exe
4932	spoolsv.exe
4964	spoolsv.exe
4996	spoolsv.exe
5028	spoolsv.exe
5060	spoolsv.exe
5092	spoolsv.exe
4104	spoolsv.exe
4192	spoolsv.exe
4252	spoolsv.exe
4316	spoolsv.exe
4396	spoolsv.exe
4476	spoolsv.exe
4544	spoolsv.exe
4620	spoolsv.exe
4700	spoolsv.exe
4764	spoolsv.exe
4844	spoolsv.exe
4908	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
"C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:3828
- C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe
  "C:\Users\Admin\AppData\Local\Temp\57efc81b39cedbb515f909f66ff27cc09c1ca699feeffb136a7515f3f444f717.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetWindowsHookEx
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    - Adds Run entry to start application
    - Executes dropped EXE
    PID:3892
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious use of SetWindowsHookEx
      Adds Run entry to start application
      Drops file in Windows directory
      Modifies WinLogon for persistence
      Suspicious behavior: EnumeratesProcesses
      Executes dropped EXE
      Modifies Installed Components in the registry
      Modifies the visibility of hidden or system files
      PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4908
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1152
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:3936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-200-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-321-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-108-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-109-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-105-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-112-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-113-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-389-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-104-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-116-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-117-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-388-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-385-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-120-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-121-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-384-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-101-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-124-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-125-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-381-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-100-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-128-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-129-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-380-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-377-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-132-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-133-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-376-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-97-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-136-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-137-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-373-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-96-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-140-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-141-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-372-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-369-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-144-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-145-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-368-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-93-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-148-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-149-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-26-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-92-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-152-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-153-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-365-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-364-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-156-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-157-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-27-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-89-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-160-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-161-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-361-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-88-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-164-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-165-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-360-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-28-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-168-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-169-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-357-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-85-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-172-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-173-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-356-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-84-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-176-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-177-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-29-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-353-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-180-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-181-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-352-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-349-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-184-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-185-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-348-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-81-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-188-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-189-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-32-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-80-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-192-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-193-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-345-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-344-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-196-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-197-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-33-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-77-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-76-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-201-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-341-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-340-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-204-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-205-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-337-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-73-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-208-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-209-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-336-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-72-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-212-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-213-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-36-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-333-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-216-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-217-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-332-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-69-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-220-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-221-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-37-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-68-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-224-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-225-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-329-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-328-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-228-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-229-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-325-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-65-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-232-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-233-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-324-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-64-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-236-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-237-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-320-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-317-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-240-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-241-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-316-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-61-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-244-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-245-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-313-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-60-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-248-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-249-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-312-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-309-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-252-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-253-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-308-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-57-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-256-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-257-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-40-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-56-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-260-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-261-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-305-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-304-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-264-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-265-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-41-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-53-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-268-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-269-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-301-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-52-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-272-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-273-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-300-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-297-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-276-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-277-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-296-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-49-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-280-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-281-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-44-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-48-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-284-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-285-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-293-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-292-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-288-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/396-289-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/396-45-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

Download

memory/1152-17-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1152-20-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3852-6-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/3852-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3852-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3852-7-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download