Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 15:43
Behavioral task
behavioral1
Sample
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe
-
Size
13.0MB
-
MD5
fd1a4389ae602d038236500becb9e716
-
SHA1
07391dfac902cf86854020fc1a869ba40c0a83ed
-
SHA256
e0b18b43ed99a197b72b79de7d522eea4eec6cd356d7b185661b171e3cbb4c40
-
SHA512
6e34b60c7aac1ec6b7dbdf810dc0f93a51cd2a0e9d6a337fe7db5066c42ee050d141fe1af05a289f507fff3e01a982ad69197bfbff739e8253f23a3326ed6822
-
SSDEEP
196608:yU7d9xZSt4U7d9xZStSU7d9xZSt4U7d9xZStD:D7d9xZo7d9xZS7d9xZo7d9xZA
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\System\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 3 IoCs
Processes:
cmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 11 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3764 explorer.exe 4808 explorer.exe 1532 explorer.exe 1612 spoolsv.exe 4812 spoolsv.exe 3440 spoolsv.exe 1972 spoolsv.exe 216 spoolsv.exe 2532 spoolsv.exe 4712 spoolsv.exe 4316 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3980-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3980-4-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Windows\System\explorer.exe upx behavioral2/memory/3764-38-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3764-44-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe upx C:\Windows\System\spoolsv.exe upx behavioral2/memory/1612-84-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3440-90-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/216-102-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4712-114-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4432-127-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/904-149-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4516-164-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3244-167-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2400-189-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4188-204-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2128-219-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2928-243-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2144-262-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2100-280-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4160-297-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1008-305-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5036-387-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4940-399-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 3980 set thread context of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 set thread context of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 set thread context of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 3764 set thread context of 4808 3764 explorer.exe explorer.exe PID 4808 set thread context of 1532 4808 explorer.exe explorer.exe PID 1612 set thread context of 4812 1612 spoolsv.exe spoolsv.exe PID 3440 set thread context of 1972 3440 spoolsv.exe spoolsv.exe PID 216 set thread context of 2532 216 spoolsv.exe spoolsv.exe PID 4712 set thread context of 4316 4712 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 8 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2768 2764 WerFault.exe spoolsv.exe 640 4940 WerFault.exe spoolsv.exe 1100 3860 WerFault.exe spoolsv.exe 640 2680 WerFault.exe spoolsv.exe 1980 1476 WerFault.exe spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exepid process 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 3764 explorer.exe 3764 explorer.exe 1612 spoolsv.exe 1612 spoolsv.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 3440 spoolsv.exe 3440 spoolsv.exe 1532 explorer.exe 1532 explorer.exe 216 spoolsv.exe 216 spoolsv.exe 1532 explorer.exe 1532 explorer.exe 4712 spoolsv.exe 4712 spoolsv.exe 1532 explorer.exe 1532 explorer.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
Processes:
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe 3764 explorer.exe 3764 explorer.exe 1532 explorer.exe 1532 explorer.exe 1612 spoolsv.exe 1612 spoolsv.exe 1532 explorer.exe 1532 explorer.exe 3440 spoolsv.exe 3440 spoolsv.exe 216 spoolsv.exe 216 spoolsv.exe 4712 spoolsv.exe 4712 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd1a4389ae602d038236500becb9e716_JaffaCakes118.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exefd1a4389ae602d038236500becb9e716_JaffaCakes118.exeexplorer.exedescription pid process target process PID 3980 wrote to memory of 3192 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe cmd.exe PID 3980 wrote to memory of 3192 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe cmd.exe PID 3980 wrote to memory of 3192 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe cmd.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 3980 wrote to memory of 848 3980 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4312 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe PID 848 wrote to memory of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 848 wrote to memory of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 848 wrote to memory of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 848 wrote to memory of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 848 wrote to memory of 4304 848 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe diskperf.exe PID 4312 wrote to memory of 3764 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe explorer.exe PID 4312 wrote to memory of 3764 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe explorer.exe PID 4312 wrote to memory of 3764 4312 fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe explorer.exe PID 3764 wrote to memory of 1184 3764 explorer.exe cmd.exe PID 3764 wrote to memory of 1184 3764 explorer.exe cmd.exe PID 3764 wrote to memory of 1184 3764 explorer.exe cmd.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe PID 3764 wrote to memory of 4808 3764 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fd1a4389ae602d038236500becb9e716_JaffaCakes118.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:1184 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4808 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1500
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:5024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:4900
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:4212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2960
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:4340
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:4632
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1756
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3812
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1692
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:892
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:840
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3348
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5064
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 2009⤵
- Program crash
PID:2768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:5108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5032
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3752
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 5048⤵
- Program crash
PID:640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 5608⤵
- Program crash
PID:1100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3920
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 5048⤵
- Program crash
PID:640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5032
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4616
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3244
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4072
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1348
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4264
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3384
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 3968⤵
- Program crash
PID:1980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3440
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2804
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2764 -ip 27641⤵PID:888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4940 -ip 49401⤵PID:2216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3860 -ip 38601⤵PID:2020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2680 -ip 26801⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1476 -ip 14761⤵PID:4308
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD5fd1a4389ae602d038236500becb9e716
SHA107391dfac902cf86854020fc1a869ba40c0a83ed
SHA256e0b18b43ed99a197b72b79de7d522eea4eec6cd356d7b185661b171e3cbb4c40
SHA5126e34b60c7aac1ec6b7dbdf810dc0f93a51cd2a0e9d6a337fe7db5066c42ee050d141fe1af05a289f507fff3e01a982ad69197bfbff739e8253f23a3326ed6822
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
13.0MB
MD511ecfa831747ccfa35cb2d8dc7928f1d
SHA12af61cea3a43da272c32f70ee2b6403168b3cc89
SHA256de820e899d4838c54db97172ba3962ca97bbe64ae35a218e9c4db8fcf57ade70
SHA512ccd62af2fea13124037d8ba3401e29573676c6b6763b4e8c496ad5f3290fd62ee88bedd61f9abeaf18b4317ad02b89b23df9c23201acacd123756e9880dc1270
-
Filesize
13.0MB
MD5935e18a313ed5afcefac710654fd9621
SHA13edc1f87ce9365f0a4252732d36f4bcb59904075
SHA256818da8b75f4828c828d5d6c17a318cdf56e044337faa29eabde90beb59e251ad
SHA512a8008f356795a126b5e24414418f107480b31d3d23a996838c1c2ec551642ae0495d857ba089a607008b7ae1077f71bf12f0cd6eca134369f9728eaaac8f27df