Analysis
- max time kernel
151s - max time network
94s - platform
windows10_x64 - resource
win10v200430 - submitted
06/07/2020, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe
- Size 5.4MB
- Sample200706-vs29tx3sln
- SHA256 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775
- MD5 0db8d65654edb74ae9a691e8ad95f632
- SHA1 e955361051e157bbc9c48840f071b52bee3a9e5c
- SHA512 d5141c5576f26cf81c9d4816506f00211001ff7eb2ebd929780941b3547451479374c70f8cebc72abb9bd1956233bd4b581ee4cf547504a80538367c0fee86fe
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe - Suspicious use of WriteProcessMemory 274 IoCs
description pid Process procid_target PID 2916 wrote to memory of 560 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 66 PID 2916 wrote to memory of 560 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 66 PID 2916 wrote to memory of 560 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 66 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 2916 wrote to memory of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 wrote to memory of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 904 wrote to memory of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 904 wrote to memory of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 904 wrote to memory of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 904 wrote to memory of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 3740 wrote to memory of 3996 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 77 PID 3740 wrote to memory of 3996 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 77 PID 3740 wrote to memory of 3996 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 77 PID 3996 wrote to memory of 3516 3996 explorer.exe 78 PID 3996 wrote to memory of 3516 3996 explorer.exe 78 PID 3996 wrote to memory of 3516 3996 explorer.exe 78 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3996 wrote to memory of 3496 3996 explorer.exe 80 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 2452 3496 explorer.exe 81 PID 3496 wrote to memory of 756 3496 explorer.exe 82 PID 3496 wrote to memory of 756 3496 explorer.exe 82 PID 3496 wrote to memory of 756 3496 explorer.exe 82 PID 3496 wrote to memory of 756 3496 explorer.exe 82 PID 3496 wrote to memory of 756 3496 explorer.exe 82 PID 2452 wrote to memory of 2236 2452 explorer.exe 83 PID 2452 wrote to memory of 2236 2452 explorer.exe 83 PID 2452 wrote to memory of 2236 2452 explorer.exe 83 PID 2236 wrote to memory of 4068 2236 spoolsv.exe 84 PID 2236 wrote to memory of 4068 2236 spoolsv.exe 84 PID 2236 wrote to memory of 4068 2236 spoolsv.exe 84 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2236 wrote to memory of 3696 2236 spoolsv.exe 86 PID 2452 wrote to memory of 640 2452 explorer.exe 87 PID 2452 wrote to memory of 640 2452 explorer.exe 87 PID 2452 wrote to memory of 640 2452 explorer.exe 87 PID 640 wrote to memory of 800 640 spoolsv.exe 88 PID 640 wrote to memory of 800 640 spoolsv.exe 88 PID 640 wrote to memory of 800 640 spoolsv.exe 88 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 640 wrote to memory of 3172 640 spoolsv.exe 90 PID 2452 wrote to memory of 1236 2452 explorer.exe 91 PID 2452 wrote to memory of 1236 2452 explorer.exe 91 PID 2452 wrote to memory of 1236 2452 explorer.exe 91 PID 1236 wrote to memory of 1128 1236 spoolsv.exe 92 PID 1236 wrote to memory of 1128 1236 spoolsv.exe 92 PID 1236 wrote to memory of 1128 1236 spoolsv.exe 92 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 1236 wrote to memory of 1188 1236 spoolsv.exe 94 PID 2452 wrote to memory of 1148 2452 explorer.exe 95 PID 2452 wrote to memory of 1148 2452 explorer.exe 95 PID 2452 wrote to memory of 1148 2452 explorer.exe 95 PID 1148 wrote to memory of 680 1148 spoolsv.exe 96 PID 1148 wrote to memory of 680 1148 spoolsv.exe 96 PID 1148 wrote to memory of 680 1148 spoolsv.exe 96 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 1148 wrote to memory of 2448 1148 spoolsv.exe 98 PID 2452 wrote to memory of 3004 2452 explorer.exe 99 PID 2452 wrote to memory of 3004 2452 explorer.exe 99 PID 2452 wrote to memory of 3004 2452 explorer.exe 99 PID 3004 wrote to memory of 900 3004 spoolsv.exe 100 PID 3004 wrote to memory of 900 3004 spoolsv.exe 100 PID 3004 wrote to memory of 900 3004 spoolsv.exe 100 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 3004 wrote to memory of 3524 3004 spoolsv.exe 102 PID 2452 wrote to memory of 3948 2452 explorer.exe 103 PID 2452 wrote to memory of 3948 2452 explorer.exe 103 PID 2452 wrote to memory of 3948 2452 explorer.exe 103 PID 3948 wrote to memory of 3516 3948 spoolsv.exe 104 PID 3948 wrote to memory of 3516 3948 spoolsv.exe 104 PID 3948 wrote to memory of 3516 3948 spoolsv.exe 104 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3996 explorer.exe 3996 explorer.exe 2236 spoolsv.exe 2236 spoolsv.exe 2452 explorer.exe 2452 explorer.exe 2452 explorer.exe 2452 explorer.exe 640 spoolsv.exe 640 spoolsv.exe 2452 explorer.exe 2452 explorer.exe 1236 spoolsv.exe 1236 spoolsv.exe 2452 explorer.exe 2452 explorer.exe 1148 spoolsv.exe 1148 spoolsv.exe 2452 explorer.exe 2452 explorer.exe 3004 spoolsv.exe 3004 spoolsv.exe 2452 explorer.exe 2452 explorer.exe - Executes dropped EXE 14 IoCs
pid Process 3996 explorer.exe 3496 explorer.exe 2452 explorer.exe 2236 spoolsv.exe 3696 spoolsv.exe 640 spoolsv.exe 3172 spoolsv.exe 1236 spoolsv.exe 1188 spoolsv.exe 1148 spoolsv.exe 2448 spoolsv.exe 3004 spoolsv.exe 3524 spoolsv.exe 3948 spoolsv.exe - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Adds Run entry to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe - Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3740 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 3996 explorer.exe 3996 explorer.exe 2452 explorer.exe 2452 explorer.exe 2236 spoolsv.exe 2236 spoolsv.exe 2452 explorer.exe 2452 explorer.exe 640 spoolsv.exe 640 spoolsv.exe 1236 spoolsv.exe 1236 spoolsv.exe 1148 spoolsv.exe 1148 spoolsv.exe 3004 spoolsv.exe 3004 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe - Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 2916 set thread context of 904 2916 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 68 PID 904 set thread context of 3740 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 75 PID 904 set thread context of 3316 904 fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe 76 PID 3996 set thread context of 3496 3996 explorer.exe 80 PID 3496 set thread context of 2452 3496 explorer.exe 81 PID 3496 set thread context of 756 3496 explorer.exe 82 PID 2236 set thread context of 3696 2236 spoolsv.exe 86 PID 640 set thread context of 3172 640 spoolsv.exe 90 PID 1236 set thread context of 1188 1236 spoolsv.exe 94 PID 1148 set thread context of 2448 1148 spoolsv.exe 98 PID 3004 set thread context of 3524 3004 spoolsv.exe 102 - Modifies the visibility of hidden or system files 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe"C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exeC:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe2⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious use of SetThreadContext
PID:904 -
C:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exeC:\Users\Admin\AppData\Local\Temp\fb8aef0f4faaf86fed3ed65eb84b8a1a5b3a50605e5f4e6f341de33e898d3775.exe3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3740 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:3516
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run entry to start application
- Suspicious use of SetThreadContext
PID:3496 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Modifies WinLogon for persistence
- Adds Run entry to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Modifies the visibility of hidden or system files
PID:2452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3172
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:900
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3524
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3516
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:756
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:3316
-
-