Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 13:03
Behavioral task
behavioral1
Sample
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
07ba1351e328ef8ae70c7a92151d9050
-
SHA1
b224c6b298f8daa6f2ef2d452adfd244200b7875
-
SHA256
5859f8a265da4569ec80b59f59f773240fb702c083cb91d602fc9e54c4962e5f
-
SHA512
61db9af39165108916fb57c91f15420d5be5fe99eacbd0fd032f0f21ae85c4972b6c61d89f0834088ad29a88b442c0936e4d20161aa3b6e8c8127f95fbefdc28
-
SSDEEP
24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHA:3Ty7A3mw4gxeOw46fUbNecCCFbNecr
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 35 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2728 explorer.exe 3044 explorer.exe 452 explorer.exe 1648 spoolsv.exe 1984 spoolsv.exe 1156 spoolsv.exe 1088 spoolsv.exe 2368 spoolsv.exe 2692 spoolsv.exe 2172 spoolsv.exe 3040 spoolsv.exe 1900 spoolsv.exe 1660 spoolsv.exe 2716 spoolsv.exe 1676 spoolsv.exe 2168 spoolsv.exe 1572 spoolsv.exe 972 spoolsv.exe 2240 spoolsv.exe 2268 spoolsv.exe 1160 spoolsv.exe 2588 spoolsv.exe 2500 spoolsv.exe 2900 spoolsv.exe 2564 spoolsv.exe 1208 spoolsv.exe 716 spoolsv.exe 1924 spoolsv.exe 1284 spoolsv.exe 1640 spoolsv.exe 1724 spoolsv.exe 2492 spoolsv.exe 2796 spoolsv.exe 2624 spoolsv.exe 2688 spoolsv.exe 3056 spoolsv.exe 2712 spoolsv.exe 2812 spoolsv.exe 1908 spoolsv.exe 1476 spoolsv.exe 1480 spoolsv.exe 1560 spoolsv.exe 1936 spoolsv.exe 2656 spoolsv.exe 1636 spoolsv.exe 2976 spoolsv.exe 2876 spoolsv.exe 2772 spoolsv.exe 2800 spoolsv.exe 2900 spoolsv.exe 2388 spoolsv.exe 692 spoolsv.exe 1664 spoolsv.exe 1924 spoolsv.exe 2448 spoolsv.exe 944 spoolsv.exe 2360 spoolsv.exe 2560 spoolsv.exe 2616 spoolsv.exe 276 spoolsv.exe 2588 spoolsv.exe 3056 spoolsv.exe 2764 spoolsv.exe 1456 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 452 explorer.exe 452 explorer.exe 1648 spoolsv.exe 452 explorer.exe 452 explorer.exe 1156 spoolsv.exe 452 explorer.exe 452 explorer.exe 2368 spoolsv.exe 452 explorer.exe 452 explorer.exe 2172 spoolsv.exe 452 explorer.exe 452 explorer.exe 1900 spoolsv.exe 452 explorer.exe 452 explorer.exe 2716 spoolsv.exe 452 explorer.exe 452 explorer.exe 2168 spoolsv.exe 452 explorer.exe 452 explorer.exe 972 spoolsv.exe 452 explorer.exe 452 explorer.exe 2268 spoolsv.exe 452 explorer.exe 452 explorer.exe 2588 spoolsv.exe 452 explorer.exe 452 explorer.exe 2900 spoolsv.exe 452 explorer.exe 452 explorer.exe 1208 spoolsv.exe 452 explorer.exe 452 explorer.exe 1924 spoolsv.exe 452 explorer.exe 452 explorer.exe 1640 spoolsv.exe 452 explorer.exe 452 explorer.exe 2492 spoolsv.exe 452 explorer.exe 452 explorer.exe 2624 spoolsv.exe 452 explorer.exe 452 explorer.exe 3056 spoolsv.exe 452 explorer.exe 452 explorer.exe 2812 spoolsv.exe 452 explorer.exe 452 explorer.exe 1476 spoolsv.exe 452 explorer.exe 452 explorer.exe 1560 spoolsv.exe 452 explorer.exe 452 explorer.exe -
Adds Run key to start application 2 TTPs 15 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 2964 set thread context of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 set thread context of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 set thread context of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2728 set thread context of 3044 2728 explorer.exe explorer.exe PID 3044 set thread context of 452 3044 explorer.exe explorer.exe PID 3044 set thread context of 2164 3044 explorer.exe diskperf.exe PID 1648 set thread context of 1984 1648 spoolsv.exe spoolsv.exe PID 1156 set thread context of 1088 1156 spoolsv.exe spoolsv.exe PID 2368 set thread context of 2692 2368 spoolsv.exe spoolsv.exe PID 2172 set thread context of 3040 2172 spoolsv.exe spoolsv.exe PID 1900 set thread context of 1660 1900 spoolsv.exe spoolsv.exe PID 2716 set thread context of 1676 2716 spoolsv.exe spoolsv.exe PID 2168 set thread context of 1572 2168 spoolsv.exe spoolsv.exe PID 972 set thread context of 2240 972 spoolsv.exe spoolsv.exe PID 2268 set thread context of 1160 2268 spoolsv.exe spoolsv.exe PID 2588 set thread context of 2500 2588 spoolsv.exe spoolsv.exe PID 2900 set thread context of 2564 2900 spoolsv.exe spoolsv.exe PID 1208 set thread context of 716 1208 spoolsv.exe spoolsv.exe PID 1924 set thread context of 1284 1924 spoolsv.exe spoolsv.exe PID 1640 set thread context of 1724 1640 spoolsv.exe spoolsv.exe PID 2492 set thread context of 2796 2492 spoolsv.exe spoolsv.exe PID 2624 set thread context of 2688 2624 spoolsv.exe spoolsv.exe PID 3056 set thread context of 2712 3056 spoolsv.exe spoolsv.exe PID 2812 set thread context of 1908 2812 spoolsv.exe spoolsv.exe PID 1476 set thread context of 1480 1476 spoolsv.exe spoolsv.exe PID 1560 set thread context of 1936 1560 spoolsv.exe spoolsv.exe PID 2656 set thread context of 1636 2656 spoolsv.exe spoolsv.exe PID 2976 set thread context of 2876 2976 spoolsv.exe spoolsv.exe PID 2772 set thread context of 2800 2772 spoolsv.exe spoolsv.exe PID 2900 set thread context of 2388 2900 spoolsv.exe spoolsv.exe PID 692 set thread context of 1664 692 spoolsv.exe spoolsv.exe PID 1924 set thread context of 2448 1924 spoolsv.exe spoolsv.exe PID 944 set thread context of 2360 944 spoolsv.exe spoolsv.exe PID 2560 set thread context of 2616 2560 spoolsv.exe spoolsv.exe PID 276 set thread context of 2588 276 spoolsv.exe spoolsv.exe PID 3056 set thread context of 2764 3056 spoolsv.exe spoolsv.exe PID 1984 set thread context of 1508 1984 spoolsv.exe spoolsv.exe PID 1456 set thread context of 2720 1456 spoolsv.exe spoolsv.exe PID 1984 set thread context of 1960 1984 spoolsv.exe diskperf.exe PID 1088 set thread context of 2168 1088 spoolsv.exe spoolsv.exe PID 1088 set thread context of 992 1088 spoolsv.exe diskperf.exe PID 1844 set thread context of 1060 1844 explorer.exe explorer.exe PID 884 set thread context of 1856 884 spoolsv.exe spoolsv.exe PID 2692 set thread context of 1112 2692 spoolsv.exe spoolsv.exe PID 2692 set thread context of 1712 2692 spoolsv.exe diskperf.exe PID 3040 set thread context of 2520 3040 spoolsv.exe spoolsv.exe PID 3040 set thread context of 2184 3040 spoolsv.exe diskperf.exe PID 1540 set thread context of 2152 1540 explorer.exe explorer.exe PID 2848 set thread context of 2408 2848 spoolsv.exe spoolsv.exe PID 1660 set thread context of 2420 1660 spoolsv.exe spoolsv.exe PID 1660 set thread context of 2656 1660 spoolsv.exe diskperf.exe PID 1076 set thread context of 968 1076 spoolsv.exe spoolsv.exe PID 1676 set thread context of 2108 1676 spoolsv.exe spoolsv.exe PID 1676 set thread context of 2868 1676 spoolsv.exe diskperf.exe PID 1624 set thread context of 3028 1624 spoolsv.exe spoolsv.exe PID 1980 set thread context of 1452 1980 explorer.exe explorer.exe PID 2472 set thread context of 2824 2472 spoolsv.exe spoolsv.exe PID 1572 set thread context of 384 1572 spoolsv.exe spoolsv.exe PID 1572 set thread context of 2180 1572 spoolsv.exe diskperf.exe PID 2240 set thread context of 2000 2240 spoolsv.exe spoolsv.exe PID 2240 set thread context of 1612 2240 spoolsv.exe diskperf.exe PID 1160 set thread context of 2292 1160 spoolsv.exe spoolsv.exe PID 1160 set thread context of 1772 1160 spoolsv.exe diskperf.exe PID 108 set thread context of 2696 108 explorer.exe explorer.exe -
Drops file in Windows directory 47 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2728 explorer.exe 1648 spoolsv.exe 452 explorer.exe 452 explorer.exe 1156 spoolsv.exe 452 explorer.exe 2368 spoolsv.exe 452 explorer.exe 2172 spoolsv.exe 452 explorer.exe 1900 spoolsv.exe 452 explorer.exe 2716 spoolsv.exe 452 explorer.exe 2168 spoolsv.exe 452 explorer.exe 972 spoolsv.exe 452 explorer.exe 2268 spoolsv.exe 452 explorer.exe 2588 spoolsv.exe 452 explorer.exe 2900 spoolsv.exe 452 explorer.exe 1208 spoolsv.exe 452 explorer.exe 1924 spoolsv.exe 452 explorer.exe 1640 spoolsv.exe 452 explorer.exe 2492 spoolsv.exe 452 explorer.exe 2624 spoolsv.exe 452 explorer.exe 3056 spoolsv.exe 452 explorer.exe 2812 spoolsv.exe 452 explorer.exe 1476 spoolsv.exe 452 explorer.exe 1560 spoolsv.exe 452 explorer.exe 2656 spoolsv.exe 452 explorer.exe 2976 spoolsv.exe 452 explorer.exe 2772 spoolsv.exe 452 explorer.exe 2900 spoolsv.exe 452 explorer.exe 692 spoolsv.exe 452 explorer.exe 1924 spoolsv.exe 452 explorer.exe 944 spoolsv.exe 452 explorer.exe 2560 spoolsv.exe 452 explorer.exe 276 spoolsv.exe 452 explorer.exe 3056 spoolsv.exe 452 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 2728 explorer.exe 2728 explorer.exe 452 explorer.exe 452 explorer.exe 1648 spoolsv.exe 1648 spoolsv.exe 452 explorer.exe 452 explorer.exe 1156 spoolsv.exe 1156 spoolsv.exe 2368 spoolsv.exe 2368 spoolsv.exe 2172 spoolsv.exe 2172 spoolsv.exe 1900 spoolsv.exe 1900 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 2168 spoolsv.exe 2168 spoolsv.exe 972 spoolsv.exe 972 spoolsv.exe 2268 spoolsv.exe 2268 spoolsv.exe 2588 spoolsv.exe 2588 spoolsv.exe 2900 spoolsv.exe 2900 spoolsv.exe 1208 spoolsv.exe 1208 spoolsv.exe 1924 spoolsv.exe 1924 spoolsv.exe 1640 spoolsv.exe 1640 spoolsv.exe 2492 spoolsv.exe 2492 spoolsv.exe 2624 spoolsv.exe 2624 spoolsv.exe 3056 spoolsv.exe 3056 spoolsv.exe 2812 spoolsv.exe 2812 spoolsv.exe 1476 spoolsv.exe 1476 spoolsv.exe 1560 spoolsv.exe 1560 spoolsv.exe 2656 spoolsv.exe 2656 spoolsv.exe 2976 spoolsv.exe 2976 spoolsv.exe 2772 spoolsv.exe 2772 spoolsv.exe 2900 spoolsv.exe 2900 spoolsv.exe 692 spoolsv.exe 692 spoolsv.exe 1924 spoolsv.exe 1924 spoolsv.exe 944 spoolsv.exe 944 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeexplorer.exedescription pid process target process PID 2964 wrote to memory of 1108 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1108 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1108 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1108 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2964 wrote to memory of 2980 2964 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2112 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2980 wrote to memory of 2732 2980 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe diskperf.exe PID 2112 wrote to memory of 2728 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe explorer.exe PID 2112 wrote to memory of 2728 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe explorer.exe PID 2112 wrote to memory of 2728 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe explorer.exe PID 2112 wrote to memory of 2728 2112 07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe explorer.exe PID 2728 wrote to memory of 2880 2728 explorer.exe cmd.exe PID 2728 wrote to memory of 2880 2728 explorer.exe cmd.exe PID 2728 wrote to memory of 2880 2728 explorer.exe cmd.exe PID 2728 wrote to memory of 2880 2728 explorer.exe cmd.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe PID 2728 wrote to memory of 3044 2728 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\07ba1351e328ef8ae70c7a92151d9050_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:2880 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:3044 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1984 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1508
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:1596 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1060
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2348
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2168
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:992
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2692 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2540
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2152
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1096 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:3040 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2520
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2420
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2664 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1452
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2656
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2108
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:384
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2180
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2000
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2696
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2292
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2684
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:1264
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2356
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2552
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:2120
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1896 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2948 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2684 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2688 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1048
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2388 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1164 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2820 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:412
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2164
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:2732
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD507ba1351e328ef8ae70c7a92151d9050
SHA1b224c6b298f8daa6f2ef2d452adfd244200b7875
SHA2565859f8a265da4569ec80b59f59f773240fb702c083cb91d602fc9e54c4962e5f
SHA51261db9af39165108916fb57c91f15420d5be5fe99eacbd0fd032f0f21ae85c4972b6c61d89f0834088ad29a88b442c0936e4d20161aa3b6e8c8127f95fbefdc28
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
2.9MB
MD5aa2e561e8dcc509c43d2d9c7eeaa19ea
SHA1c32dfaf50138540ddfde1127f805471a22e4c5a7
SHA256be8b423c59f4da38849991a4fcf81bded6ed88d9564018a647390bd83bfa9578
SHA512ff5881d4dd7de02f228a50ecab8b41aa3e9b76a86159e3e1515dceaa2397d3dae6abc0f838350da3cec596d71f7784b444444667cabeb13f22ae0415daf3ae80
-
Filesize
2.9MB
MD5671fb6400d37d8fad99e3898fa000d09
SHA1e2d02ea0c1c45a77a41ca831ef635b1eb55f8e12
SHA2568c739232396e9a05555d27a16ced32faa91c5fe17b7ef3161f3a0c9b6468a521
SHA512701f153fd40954fc1489ccdb7b053360b0c76d70962c184a50e5344c8477f7dc22938f5941b9cc0802bd0da6e622fff9e201ca5c4ef104e9cf5054263fc7837e