fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775

Analysis

max time kernel
115s
max time network
66s
platform
windows7_x64
resource
win7
submitted
06/07/2020, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
Size 5.4MB
Sample200706-vs29tx3sln
SHA256 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775
MD5 0db8d65654edb74ae9a691e8ad95f632
SHA1 e955361051e157bbc9c48840f071b52bee3a9e5c
SHA512 d5141c5576f26cf81c9d4816506f00211001ff7eb2ebd929780941b3547451479374c70f8cebc72abb9bd1956233bd4b581ee4cf547504a80538367c0fee86fe
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of WriteProcessMemory 189 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1256	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	24
PID 1100 wrote to memory of 1256	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	24
PID 1100 wrote to memory of 1256	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	24
PID 1100 wrote to memory of 1256	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	24
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1100 wrote to memory of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1260 wrote to memory of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1796 wrote to memory of 1852	1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	31
PID 1796 wrote to memory of 1852	1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	31
PID 1796 wrote to memory of 1852	1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	31
PID 1796 wrote to memory of 1852	1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	31
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1732	1852	explorer.exe	32
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1852 wrote to memory of 1580	1852	explorer.exe	34
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1872	1580	explorer.exe	35
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1580 wrote to memory of 1904	1580	explorer.exe	36
PID 1872 wrote to memory of 1960	1872	explorer.exe	37
PID 1872 wrote to memory of 1960	1872	explorer.exe	37
PID 1872 wrote to memory of 1960	1872	explorer.exe	37
PID 1872 wrote to memory of 1960	1872	explorer.exe	37
PID 1960 wrote to memory of 1932	1960	spoolsv.exe	38
PID 1960 wrote to memory of 1932	1960	spoolsv.exe	38
PID 1960 wrote to memory of 1932	1960	spoolsv.exe	38
PID 1960 wrote to memory of 1932	1960	spoolsv.exe	38
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1960 wrote to memory of 2044	1960	spoolsv.exe	40
PID 1872 wrote to memory of 1032	1872	explorer.exe	41
PID 1872 wrote to memory of 1032	1872	explorer.exe	41
PID 1872 wrote to memory of 1032	1872	explorer.exe	41
PID 1872 wrote to memory of 1032	1872	explorer.exe	41
PID 1032 wrote to memory of 1348	1032	spoolsv.exe	42
PID 1032 wrote to memory of 1348	1032	spoolsv.exe	42
PID 1032 wrote to memory of 1348	1032	spoolsv.exe	42
PID 1032 wrote to memory of 1348	1032	spoolsv.exe	42
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1032 wrote to memory of 2036	1032	spoolsv.exe	44
PID 1872 wrote to memory of 1552	1872	explorer.exe	45
PID 1872 wrote to memory of 1552	1872	explorer.exe	45
PID 1872 wrote to memory of 1552	1872	explorer.exe	45
PID 1872 wrote to memory of 1552	1872	explorer.exe	45
PID 1552 wrote to memory of 1672	1552	spoolsv.exe	46
PID 1552 wrote to memory of 1672	1552	spoolsv.exe	46
PID 1552 wrote to memory of 1672	1552	spoolsv.exe	46
PID 1552 wrote to memory of 1672	1552	spoolsv.exe	46
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1552 wrote to memory of 1676	1552	spoolsv.exe	48
PID 1872 wrote to memory of 1792	1872	explorer.exe	49
PID 1872 wrote to memory of 1792	1872	explorer.exe	49
PID 1872 wrote to memory of 1792	1872	explorer.exe	49
PID 1872 wrote to memory of 1792	1872	explorer.exe	49
PID 1792 wrote to memory of 1804	1792	spoolsv.exe	50
PID 1792 wrote to memory of 1804	1792	spoolsv.exe	50
PID 1792 wrote to memory of 1804	1792	spoolsv.exe	50
PID 1792 wrote to memory of 1804	1792	spoolsv.exe	50

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 1260	1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	26
PID 1260 set thread context of 1796	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	29
PID 1260 set thread context of 1160	1260	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe	30
PID 1852 set thread context of 1580	1852	explorer.exe	34
PID 1580 set thread context of 1872	1580	explorer.exe	35
PID 1580 set thread context of 1904	1580	explorer.exe	36
PID 1960 set thread context of 2044	1960	spoolsv.exe	40
PID 1032 set thread context of 2036	1032	spoolsv.exe	44
PID 1552 set thread context of 1676	1552	spoolsv.exe	48

Loads dropped DLL 13 IoCs

pid	Process
1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1872	explorer.exe
1872	explorer.exe
1960	spoolsv.exe
1872	explorer.exe
1872	explorer.exe
1032	spoolsv.exe
1872	explorer.exe
1872	explorer.exe
1552	spoolsv.exe
1872	explorer.exe
1872	explorer.exe

Executes dropped EXE 10 IoCs

pid	Process
1852	explorer.exe
1580	explorer.exe
1872	explorer.exe
1960	spoolsv.exe
2044	spoolsv.exe
1032	spoolsv.exe
2036	spoolsv.exe
1552	spoolsv.exe
1676	spoolsv.exe
1792	spoolsv.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1852	explorer.exe
1852	explorer.exe
1872	explorer.exe
1872	explorer.exe
1960	spoolsv.exe
1960	spoolsv.exe
1872	explorer.exe
1872	explorer.exe
1032	spoolsv.exe
1032	spoolsv.exe
1552	spoolsv.exe
1552	spoolsv.exe
1792	spoolsv.exe
1792	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1796	fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
1852	explorer.exe
1960	spoolsv.exe
1872	explorer.exe
1872	explorer.exe
1032	spoolsv.exe
1872	explorer.exe
1552	spoolsv.exe
1872	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
"C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
  C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
  2⤵
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
    C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious behavior: EnumeratesProcesses
    PID:1796
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious behavior: EnumeratesProcesses
      PID:1852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        
        PID:1732
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:1580
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Adds Run entry to start application
        Loads dropped DLL
        Executes dropped EXE
        Drops file in Windows directory
        Modifies the visibility of hidden or system files
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        Modifies WinLogon for persistence
        Modifies Installed Components in the registry
        
        PID:1872
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Loads dropped DLL
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1932
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Loads dropped DLL
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1348
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2036
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Loads dropped DLL
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1672
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1676
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1804
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1904
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-14-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1160-9-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1260-4-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1260-5-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1260-1-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1580-32-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/1796-16-0x00000000031F0000-0x0000000003201000-memory.dmp

Download

memory/1796-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1796-15-0x0000000002DE0000-0x0000000002DF1000-memory.dmp

Download

memory/1796-30-0x0000000000350000-0x0000000000354000-memory.dmp

Download

memory/1796-31-0x00000000027E0000-0x00000000027E4000-memory.dmp

Download

memory/1796-18-0x0000000002DE0000-0x0000000002DF1000-memory.dmp

Download

memory/1796-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1872-61-0x0000000003240000-0x0000000003251000-memory.dmp

Download

memory/1872-59-0x0000000003240000-0x0000000003251000-memory.dmp

Download

memory/1872-58-0x0000000002E30000-0x0000000002E41000-memory.dmp

Download

memory/1872-75-0x0000000002E30000-0x0000000002E41000-memory.dmp

Download

memory/1872-60-0x0000000002E30000-0x0000000002E41000-memory.dmp

Download

memory/1872-93-0x0000000003240000-0x0000000003251000-memory.dmp

Download

memory/1872-77-0x0000000003240000-0x0000000003251000-memory.dmp

Download

memory/1872-92-0x0000000002E30000-0x0000000002E41000-memory.dmp

Download

memory/2036-87-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download

memory/2044-69-0x0000000000400000-0x0000000006FD0000-memory.dmp

Download