Overview

overview

10

Static

static

10

0c4f431442...18.exe

windows7-x64

10

0c4f431442...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-05-2024 16:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    0c4f4314423681f5f31d408ef5c31f8d

  • SHA1

    dc100ab7614bd30e67927487704acc813c08baeb

  • SHA256

    36ac70c8f1bb2cc876445162d66a8846a5344f0ba644d3d7723058a053d38940

  • SHA512

    cde37608aab207c3ef2fbe62bef38ab8e9d3e77e1a98226d19874451484e3d5d925382e4f5e1ce6df10cfc61621982453b16e4fa20bf107d8970e3da7e242761

  • SSDEEP

    24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81c:fF6mw4gxeOw46fUbNecCCFbNecq

Score
10/10
warzoneratevasioninfostealerpersistenceratupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT payload 3 IoCs
    rat
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Drops startup file 29 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Suspicious use of SetThreadContext 64 IoCs
  • Drops file in Windows directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
      2⤵
      • Drops startup file
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\0c4f4314423681f5f31d408ef5c31f8d_JaffaCakes118.exe
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2732
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
            5⤵
            • Drops startup file
            PID:624
          • \??\c:\windows\system\explorer.exe
            c:\windows\system\explorer.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            PID:1644
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visiblity of hidden/system files in Explorer
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:560
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:960
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                  8⤵
                  • Drops startup file
                  PID:2776
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  PID:924
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe
                    9⤵
                      PID:1920
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        10⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2132
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                          11⤵
                          • Drops startup file
                          PID:412
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          11⤵
                            PID:768
                      • C:\Windows\SysWOW64\diskperf.exe
                        "C:\Windows\SysWOW64\diskperf.exe"
                        9⤵
                          PID:1648
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1804
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                        8⤵
                          PID:1688
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe
                          8⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of SetThreadContext
                          PID:2928
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe
                            9⤵
                              PID:3064
                            • C:\Windows\SysWOW64\diskperf.exe
                              "C:\Windows\SysWOW64\diskperf.exe"
                              9⤵
                                PID:1612
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:2512
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                              8⤵
                                PID:2624
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe
                                8⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Suspicious use of SetThreadContext
                                PID:2548
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe
                                  9⤵
                                    PID:2540
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      10⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2424
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                        11⤵
                                          PID:2612
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          11⤵
                                            PID:1584
                                      • C:\Windows\SysWOW64\diskperf.exe
                                        "C:\Windows\SysWOW64\diskperf.exe"
                                        9⤵
                                          PID:2668
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      7⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2716
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                        8⤵
                                          PID:2588
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe
                                          8⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          PID:2460
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe
                                            9⤵
                                              PID:2472
                                            • C:\Windows\SysWOW64\diskperf.exe
                                              "C:\Windows\SysWOW64\diskperf.exe"
                                              9⤵
                                                PID:804
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            7⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2220
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                              8⤵
                                              • Drops startup file
                                              PID:2828
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe
                                              8⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Suspicious use of SetThreadContext
                                              PID:1192
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe
                                                9⤵
                                                  PID:1624
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    10⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:1000
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                      11⤵
                                                      • Drops startup file
                                                      PID:1404
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      11⤵
                                                        PID:2984
                                                  • C:\Windows\SysWOW64\diskperf.exe
                                                    "C:\Windows\SysWOW64\diskperf.exe"
                                                    9⤵
                                                      PID:2400
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1508
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                    8⤵
                                                      PID:1680
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Suspicious use of SetThreadContext
                                                      PID:1092
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe
                                                        9⤵
                                                          PID:1856
                                                        • C:\Windows\SysWOW64\diskperf.exe
                                                          "C:\Windows\SysWOW64\diskperf.exe"
                                                          9⤵
                                                            PID:2720
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetThreadContext
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2400
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                          8⤵
                                                            PID:2068
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Suspicious use of SetThreadContext
                                                            PID:2064
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe
                                                              9⤵
                                                                PID:3000
                                                              • C:\Windows\SysWOW64\diskperf.exe
                                                                "C:\Windows\SysWOW64\diskperf.exe"
                                                                9⤵
                                                                  PID:2380
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1792
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                8⤵
                                                                  PID:3040
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:3056
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe
                                                                    9⤵
                                                                      PID:2948
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        c:\windows\system\explorer.exe
                                                                        10⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        • Drops file in Windows directory
                                                                        PID:2392
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                          11⤵
                                                                          • Drops startup file
                                                                          PID:2388
                                                                        • \??\c:\windows\system\explorer.exe
                                                                          c:\windows\system\explorer.exe
                                                                          11⤵
                                                                            PID:2636
                                                                      • C:\Windows\SysWOW64\diskperf.exe
                                                                        "C:\Windows\SysWOW64\diskperf.exe"
                                                                        9⤵
                                                                          PID:2676
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetThreadContext
                                                                      • Drops file in Windows directory
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2504
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                        8⤵
                                                                        • Drops startup file
                                                                        PID:2320
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:1704
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe
                                                                          9⤵
                                                                            PID:1728
                                                                          • C:\Windows\SysWOW64\diskperf.exe
                                                                            "C:\Windows\SysWOW64\diskperf.exe"
                                                                            9⤵
                                                                              PID:2656
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of SetThreadContext
                                                                          • Drops file in Windows directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1520
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                            8⤵
                                                                            • Drops startup file
                                                                            PID:2440
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe
                                                                            8⤵
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:2584
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe
                                                                              9⤵
                                                                                PID:2272
                                                                              • C:\Windows\SysWOW64\diskperf.exe
                                                                                "C:\Windows\SysWOW64\diskperf.exe"
                                                                                9⤵
                                                                                  PID:1544
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of SetThreadContext
                                                                              • Drops file in Windows directory
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2576
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                8⤵
                                                                                • Drops startup file
                                                                                PID:2744
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                PID:2016
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe
                                                                                  9⤵
                                                                                    PID:2864
                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                      c:\windows\system\explorer.exe
                                                                                      10⤵
                                                                                        PID:2628
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                          11⤵
                                                                                            PID:1520
                                                                                      • C:\Windows\SysWOW64\diskperf.exe
                                                                                        "C:\Windows\SysWOW64\diskperf.exe"
                                                                                        9⤵
                                                                                          PID:2232
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1684
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                        8⤵
                                                                                        • Drops startup file
                                                                                        PID:1560
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe
                                                                                        8⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:784
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2796
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                        8⤵
                                                                                          PID:2040
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe
                                                                                          8⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1732
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        7⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:3064
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                          8⤵
                                                                                            PID:1816
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1548
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Drops file in Windows directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2804
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                            8⤵
                                                                                            • Drops startup file
                                                                                            PID:2116
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2980
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Drops file in Windows directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:884
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                            8⤵
                                                                                              PID:2640
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe
                                                                                              8⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1736
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            7⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2864
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                              8⤵
                                                                                                PID:2620
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1496
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:816
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:2012
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2212
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2516
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:2572
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3060
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2524
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:2100
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:888
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1716
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:2316
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:344
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2608
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:2808
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1132
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2948
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:292
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2620
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2560
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:680
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1104
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1480
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:948
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1976
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2456
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                • Drops startup file
                                                                                                PID:1792
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:500
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Drops file in Windows directory
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1660
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                8⤵
                                                                                                  PID:1000
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe
                                                                                                  8⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:896
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2084
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                  8⤵
                                                                                                  • Drops startup file
                                                                                                  PID:1592
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe
                                                                                                  8⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2320
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2452
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                  8⤵
                                                                                                  • Drops startup file
                                                                                                  PID:1960
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe
                                                                                                  8⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2952
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2744
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                  8⤵
                                                                                                    PID:1196
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe
                                                                                                    8⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2748
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1932
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                    8⤵
                                                                                                    • Drops startup file
                                                                                                    PID:1672
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe
                                                                                                    8⤵
                                                                                                      PID:2780
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    7⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:1552
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                      8⤵
                                                                                                      • Drops startup file
                                                                                                      PID:1100
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe
                                                                                                      8⤵
                                                                                                        PID:2680
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      7⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Drops file in Windows directory
                                                                                                      PID:2536
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                        8⤵
                                                                                                          PID:2792
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe
                                                                                                          8⤵
                                                                                                            PID:2040
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          7⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:2312
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                            8⤵
                                                                                                            • Drops startup file
                                                                                                            PID:1688
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe
                                                                                                            8⤵
                                                                                                              PID:2860
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            7⤵
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:2292
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                              8⤵
                                                                                                              • Drops startup file
                                                                                                              PID:2012
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe
                                                                                                              8⤵
                                                                                                                PID:1764
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              7⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:2888
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                                8⤵
                                                                                                                • Drops startup file
                                                                                                                PID:932
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe
                                                                                                                8⤵
                                                                                                                  PID:2312
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                7⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:1916
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
                                                                                                                  8⤵
                                                                                                                  • Drops startup file
                                                                                                                  PID:2852
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe
                                                                                                                  8⤵
                                                                                                                    PID:2000
                                                                                                              • C:\Windows\SysWOW64\diskperf.exe
                                                                                                                "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                                6⤵
                                                                                                                  PID:2992
                                                                                                          • C:\Windows\SysWOW64\diskperf.exe
                                                                                                            "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                            3⤵
                                                                                                              PID:700

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          MD5

                                                                                                          0c4f4314423681f5f31d408ef5c31f8d

                                                                                                          SHA1

                                                                                                          dc100ab7614bd30e67927487704acc813c08baeb

                                                                                                          SHA256

                                                                                                          36ac70c8f1bb2cc876445162d66a8846a5344f0ba644d3d7723058a053d38940

                                                                                                          SHA512

                                                                                                          cde37608aab207c3ef2fbe62bef38ab8e9d3e77e1a98226d19874451484e3d5d925382e4f5e1ce6df10cfc61621982453b16e4fa20bf107d8970e3da7e242761

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
                                                                                                          Filesize

                                                                                                          93B

                                                                                                          MD5

                                                                                                          8445bfa5a278e2f068300c604a78394b

                                                                                                          SHA1

                                                                                                          9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

                                                                                                          SHA256

                                                                                                          5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

                                                                                                          SHA512

                                                                                                          8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
                                                                                                          Filesize

                                                                                                          92B

                                                                                                          MD5

                                                                                                          13222a4bb413aaa8b92aa5b4f81d2760

                                                                                                          SHA1

                                                                                                          268a48f2fe84ed49bbdc1873a8009db8c7cba66a

                                                                                                          SHA256

                                                                                                          d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

                                                                                                          SHA512

                                                                                                          eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

                                                                                                          Download Submit

                                                                                                        • C:\Windows\system\explorer.exe
                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          MD5

                                                                                                          80ce519f96c90f783fb9b6ca9550b9f2

                                                                                                          SHA1

                                                                                                          7d797b8863781e63c518549afe36e9f607c3f97c

                                                                                                          SHA256

                                                                                                          1f0138641407030e24dcbf256ac978f940584dc755d136666b9da42801f4e730

                                                                                                          SHA512

                                                                                                          295ed8517a6f4cc6acbc681716cb92bf1fecbe0b413e8a8b29f7c9db40ba46000e5387cfba9e60bf919aaee35323ff19e7b69e32d9ebfa7cfd951884feec2637

                                                                                                          Download Submit

                                                                                                        • \Windows\system\spoolsv.exe
                                                                                                          Filesize

                                                                                                          2.7MB

                                                                                                          MD5

                                                                                                          6a31e71bd184bfbb602afa7a1073f5d1

                                                                                                          SHA1

                                                                                                          34e7d4dc675be7c31b39d0d6692ba30dcf09845a

                                                                                                          SHA256

                                                                                                          22f96f909564deafcbf2b4fe7dcef853acb9b229af351f961789f27267e8e28b

                                                                                                          SHA512

                                                                                                          1834f7dc0a4a524846ce4cbb82615e82a7b2ebada88c05947a67dadd725578d425554472de70d88304e1cb0883f925ac7d8ac7193e97c893b9718b629ee8a55b

                                                                                                          Download Submit

                                                                                                        • memory/560-650-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-426-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-1891-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-196-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-1467-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-748-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-749-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-374-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-651-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-1890-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-197-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-272-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-489-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-490-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-255-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-254-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-425-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-379-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/560-380-0x00000000032A0000-0x00000000032E5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/700-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/700-87-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                          Filesize

                                                                                                          72KB

                                                                                                          Download

                                                                                                        • memory/700-74-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                          Filesize

                                                                                                          72KB

                                                                                                          Download

                                                                                                        • memory/924-256-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/924-1729-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/960-243-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/1092-2059-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/1092-485-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/1192-433-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/1192-2038-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/1508-437-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/1644-154-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/1644-183-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/1804-257-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2020-146-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2020-101-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2220-381-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2224-0-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2224-43-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2224-4-0x0000000000730000-0x0000000000775000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2400-491-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2460-1959-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/2460-375-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/2512-274-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2548-1881-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2548-322-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2716-373-0x0000000000400000-0x0000000000445000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2732-99-0x0000000002760000-0x00000000027A5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2732-153-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                          Filesize

                                                                                                          248KB

                                                                                                          Download

                                                                                                        • memory/2732-98-0x0000000002760000-0x00000000027A5000-memory.dmp

                                                                                                          Filesize

                                                                                                          276KB

                                                                                                          Download

                                                                                                        • memory/2732-63-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                          Filesize

                                                                                                          248KB

                                                                                                          Download

                                                                                                        • memory/2732-59-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                          Filesize

                                                                                                          248KB

                                                                                                          Download

                                                                                                        • memory/2732-80-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                          Filesize

                                                                                                          248KB

                                                                                                          Download

                                                                                                        • memory/2732-62-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                          Filesize

                                                                                                          248KB

                                                                                                          Download

                                                                                                        • memory/2928-1767-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/2928-271-0x0000000000400000-0x0000000001990000-memory.dmp

                                                                                                          Filesize

                                                                                                          21.6MB

                                                                                                          Download

                                                                                                        • memory/2944-54-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-28-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-16-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-39-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-6-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-46-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-48-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-51-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-8-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-10-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-12-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-18-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-55-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-20-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-22-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-24-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-26-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-52-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-30-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-32-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/2944-36-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-42-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-44-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-45-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-47-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-85-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-49-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-53-0x0000000000400000-0x0000000000628000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.2MB

                                                                                                          Download

                                                                                                        • memory/2944-50-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-14-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-3-0x0000000000400000-0x0000000001400000-memory.dmp

                                                                                                          Filesize

                                                                                                          16.0MB

                                                                                                          Download

                                                                                                        • memory/2944-2-0x0000000000300000-0x0000000000400000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                          Download