Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 22:10
Behavioral task
behavioral1
Sample
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe
Resource
win10v2004-20240419-en
General
-
Target
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe
-
Size
2.9MB
-
MD5
07b5a07106b7195700141a74b6b9d765
-
SHA1
74330b396e102b57497498cc6db61d712a349d09
-
SHA256
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010
-
SHA512
ddb095ab64f69d2b977cc876c6d256e9e91a9b484b9407d326ea258494c7a2a295610108f2cb810feb5bb1720deec521d26c36398843565f32326133603b50d9
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHj:ATU7AAmw4gxeOw46fUbNecCCFbNecS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack 48 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-33-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-51-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-47-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-44-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-53-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-50-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-48-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-42-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-40-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-29-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-11-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-27-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-23-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-19-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-9-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-49-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-46-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-45-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-37-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-32-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-25-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-22-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-18-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-16-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-7-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-14-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1804-84-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1604-150-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1604-181-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/768-249-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2032-306-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2772-362-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2188-361-0x0000000003250000-0x0000000003296000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2720-415-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2100-468-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1740-523-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-576-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/888-632-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2532-689-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3056-740-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2052-789-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1044-840-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1252-888-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/772-937-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/320-987-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2740-1040-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2996-1093-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1500-1142-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-0-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/1680-43-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\Windows\system\explorer.exe UPX behavioral1/memory/2288-102-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe UPX \Windows\system\spoolsv.exe UPX behavioral1/memory/2188-190-0x0000000003250000-0x0000000003296000-memory.dmp UPX behavioral1/memory/2916-253-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/1824-241-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2908-307-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2916-295-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/3056-363-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2188-361-0x0000000003250000-0x0000000003296000-memory.dmp UPX behavioral1/memory/632-416-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/1248-467-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/1356-524-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2324-580-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2508-633-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2404-690-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/872-741-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2472-792-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/1344-841-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2356-891-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2356-896-0x0000000000370000-0x00000000003B6000-memory.dmp UPX behavioral1/memory/2596-940-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2596-948-0x0000000001D70000-0x0000000001DB6000-memory.dmp UPX behavioral1/memory/2844-990-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/952-1041-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral1/memory/2744-1094-0x0000000000400000-0x0000000000446000-memory.dmp UPX -
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 41 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2288 explorer.exe 1604 explorer.exe 2188 explorer.exe 1824 spoolsv.exe 768 spoolsv.exe 2916 spoolsv.exe 2032 spoolsv.exe 2908 spoolsv.exe 2772 spoolsv.exe 3056 spoolsv.exe 2720 spoolsv.exe 632 spoolsv.exe 2100 spoolsv.exe 1248 spoolsv.exe 1740 spoolsv.exe 1356 spoolsv.exe 2784 spoolsv.exe 2324 spoolsv.exe 888 spoolsv.exe 2508 spoolsv.exe 2532 spoolsv.exe 2404 spoolsv.exe 3056 spoolsv.exe 872 spoolsv.exe 2052 spoolsv.exe 2472 spoolsv.exe 1044 spoolsv.exe 1344 spoolsv.exe 1252 spoolsv.exe 2356 spoolsv.exe 772 spoolsv.exe 2596 spoolsv.exe 320 spoolsv.exe 2844 spoolsv.exe 2740 spoolsv.exe 952 spoolsv.exe 2996 spoolsv.exe 2744 spoolsv.exe 1500 spoolsv.exe 1800 spoolsv.exe 1624 spoolsv.exe 1348 spoolsv.exe 2356 spoolsv.exe 2832 spoolsv.exe 2908 spoolsv.exe 2416 spoolsv.exe 1228 spoolsv.exe 488 spoolsv.exe 2368 spoolsv.exe 1616 spoolsv.exe 712 spoolsv.exe 1144 spoolsv.exe 2104 spoolsv.exe 1696 spoolsv.exe 2088 spoolsv.exe 2040 spoolsv.exe 2700 spoolsv.exe 1820 spoolsv.exe 1512 spoolsv.exe 952 spoolsv.exe 2008 spoolsv.exe 1112 spoolsv.exe 852 spoolsv.exe 308 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2188 explorer.exe 2188 explorer.exe 1824 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2916 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2908 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 3056 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 632 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 1248 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 1356 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2324 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2508 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2404 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 872 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2472 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 1344 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2356 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2596 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2844 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 952 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2744 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 1800 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 1348 spoolsv.exe 2188 explorer.exe 2188 explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1680-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1680-43-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Windows\system\explorer.exe upx behavioral1/memory/2288-102-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe upx \Windows\system\spoolsv.exe upx behavioral1/memory/2188-190-0x0000000003250000-0x0000000003296000-memory.dmp upx behavioral1/memory/2916-253-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1824-241-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2908-307-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2916-295-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/3056-363-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/632-416-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1248-467-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1356-524-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2324-580-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2508-633-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2404-690-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/872-741-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2472-792-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1344-841-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2356-891-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2596-940-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2844-990-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/952-1041-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2744-1094-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 20 IoCs
Processes:
explorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1680 set thread context of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 set thread context of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 set thread context of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 2288 set thread context of 1604 2288 explorer.exe explorer.exe PID 1604 set thread context of 2188 1604 explorer.exe explorer.exe PID 1604 set thread context of 2124 1604 explorer.exe diskperf.exe PID 1824 set thread context of 768 1824 spoolsv.exe spoolsv.exe PID 2916 set thread context of 2032 2916 spoolsv.exe spoolsv.exe PID 2908 set thread context of 2772 2908 spoolsv.exe spoolsv.exe PID 3056 set thread context of 2720 3056 spoolsv.exe spoolsv.exe PID 632 set thread context of 2100 632 spoolsv.exe spoolsv.exe PID 1248 set thread context of 1740 1248 spoolsv.exe spoolsv.exe PID 1356 set thread context of 2784 1356 spoolsv.exe spoolsv.exe PID 2324 set thread context of 888 2324 spoolsv.exe spoolsv.exe PID 2508 set thread context of 2532 2508 spoolsv.exe spoolsv.exe PID 2404 set thread context of 3056 2404 spoolsv.exe spoolsv.exe PID 872 set thread context of 2052 872 spoolsv.exe spoolsv.exe PID 2472 set thread context of 1044 2472 spoolsv.exe spoolsv.exe PID 1344 set thread context of 1252 1344 spoolsv.exe spoolsv.exe PID 2356 set thread context of 772 2356 spoolsv.exe spoolsv.exe PID 2596 set thread context of 320 2596 spoolsv.exe spoolsv.exe PID 2844 set thread context of 2740 2844 spoolsv.exe spoolsv.exe PID 952 set thread context of 2996 952 spoolsv.exe spoolsv.exe PID 2744 set thread context of 1500 2744 spoolsv.exe spoolsv.exe PID 1800 set thread context of 1624 1800 spoolsv.exe spoolsv.exe PID 1348 set thread context of 2356 1348 spoolsv.exe spoolsv.exe PID 2832 set thread context of 2908 2832 spoolsv.exe spoolsv.exe PID 2416 set thread context of 1228 2416 spoolsv.exe spoolsv.exe PID 488 set thread context of 2368 488 spoolsv.exe spoolsv.exe PID 1616 set thread context of 712 1616 spoolsv.exe spoolsv.exe PID 1144 set thread context of 2104 1144 spoolsv.exe spoolsv.exe PID 1696 set thread context of 2088 1696 spoolsv.exe spoolsv.exe PID 2040 set thread context of 2700 2040 spoolsv.exe spoolsv.exe PID 1820 set thread context of 1512 1820 spoolsv.exe spoolsv.exe PID 952 set thread context of 2008 952 spoolsv.exe spoolsv.exe PID 1112 set thread context of 852 1112 spoolsv.exe spoolsv.exe PID 308 set thread context of 1340 308 spoolsv.exe spoolsv.exe PID 2180 set thread context of 2076 2180 spoolsv.exe spoolsv.exe PID 2248 set thread context of 240 2248 spoolsv.exe spoolsv.exe PID 2176 set thread context of 2684 2176 spoolsv.exe spoolsv.exe PID 1924 set thread context of 2224 1924 spoolsv.exe spoolsv.exe PID 768 set thread context of 1872 768 spoolsv.exe spoolsv.exe PID 768 set thread context of 1584 768 spoolsv.exe diskperf.exe PID 2284 set thread context of 2372 2284 spoolsv.exe spoolsv.exe PID 2032 set thread context of 1716 2032 spoolsv.exe spoolsv.exe PID 2032 set thread context of 2204 2032 spoolsv.exe diskperf.exe PID 1380 set thread context of 2300 1380 explorer.exe explorer.exe PID 2332 set thread context of 1068 2332 spoolsv.exe spoolsv.exe PID 2772 set thread context of 2292 2772 spoolsv.exe spoolsv.exe PID 2772 set thread context of 2516 2772 spoolsv.exe diskperf.exe PID 2720 set thread context of 984 2720 spoolsv.exe spoolsv.exe PID 2720 set thread context of 340 2720 spoolsv.exe diskperf.exe PID 2920 set thread context of 676 2920 explorer.exe explorer.exe PID 2100 set thread context of 1316 2100 spoolsv.exe spoolsv.exe PID 2464 set thread context of 1568 2464 spoolsv.exe spoolsv.exe PID 2100 set thread context of 2324 2100 spoolsv.exe diskperf.exe PID 1740 set thread context of 936 1740 spoolsv.exe spoolsv.exe PID 1740 set thread context of 1040 1740 spoolsv.exe diskperf.exe PID 2784 set thread context of 2208 2784 spoolsv.exe spoolsv.exe PID 2784 set thread context of 2288 2784 spoolsv.exe diskperf.exe PID 1916 set thread context of 1396 1916 spoolsv.exe spoolsv.exe PID 3052 set thread context of 2696 3052 explorer.exe explorer.exe PID 888 set thread context of 2716 888 spoolsv.exe spoolsv.exe PID 888 set thread context of 2804 888 spoolsv.exe diskperf.exe -
Drops file in Windows directory 54 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1744 2008 WerFault.exe spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2288 explorer.exe 1824 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2916 spoolsv.exe 2188 explorer.exe 2908 spoolsv.exe 2188 explorer.exe 3056 spoolsv.exe 2188 explorer.exe 632 spoolsv.exe 2188 explorer.exe 1248 spoolsv.exe 2188 explorer.exe 1356 spoolsv.exe 2188 explorer.exe 2324 spoolsv.exe 2188 explorer.exe 2508 spoolsv.exe 2188 explorer.exe 2404 spoolsv.exe 2188 explorer.exe 872 spoolsv.exe 2188 explorer.exe 2472 spoolsv.exe 2188 explorer.exe 1344 spoolsv.exe 2188 explorer.exe 2356 spoolsv.exe 2188 explorer.exe 2596 spoolsv.exe 2188 explorer.exe 2844 spoolsv.exe 2188 explorer.exe 952 spoolsv.exe 2188 explorer.exe 2744 spoolsv.exe 2188 explorer.exe 1800 spoolsv.exe 2188 explorer.exe 1348 spoolsv.exe 2188 explorer.exe 2832 spoolsv.exe 2188 explorer.exe 2416 spoolsv.exe 2188 explorer.exe 488 spoolsv.exe 2188 explorer.exe 1616 spoolsv.exe 2188 explorer.exe 1144 spoolsv.exe 2188 explorer.exe 1696 spoolsv.exe 2188 explorer.exe 2040 spoolsv.exe 2188 explorer.exe 1820 spoolsv.exe 2188 explorer.exe 952 spoolsv.exe 2188 explorer.exe 1112 spoolsv.exe 2188 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 2288 explorer.exe 2288 explorer.exe 2188 explorer.exe 2188 explorer.exe 1824 spoolsv.exe 1824 spoolsv.exe 2188 explorer.exe 2188 explorer.exe 2916 spoolsv.exe 2916 spoolsv.exe 2908 spoolsv.exe 2908 spoolsv.exe 3056 spoolsv.exe 3056 spoolsv.exe 632 spoolsv.exe 632 spoolsv.exe 1248 spoolsv.exe 1248 spoolsv.exe 1356 spoolsv.exe 1356 spoolsv.exe 2324 spoolsv.exe 2324 spoolsv.exe 2508 spoolsv.exe 2508 spoolsv.exe 2404 spoolsv.exe 2404 spoolsv.exe 872 spoolsv.exe 872 spoolsv.exe 2472 spoolsv.exe 2472 spoolsv.exe 1344 spoolsv.exe 1344 spoolsv.exe 2356 spoolsv.exe 2356 spoolsv.exe 2596 spoolsv.exe 2596 spoolsv.exe 2844 spoolsv.exe 2844 spoolsv.exe 952 spoolsv.exe 952 spoolsv.exe 2744 spoolsv.exe 2744 spoolsv.exe 1800 spoolsv.exe 1800 spoolsv.exe 1348 spoolsv.exe 1348 spoolsv.exe 2832 spoolsv.exe 2832 spoolsv.exe 2416 spoolsv.exe 2416 spoolsv.exe 488 spoolsv.exe 488 spoolsv.exe 1616 spoolsv.exe 1616 spoolsv.exe 1144 spoolsv.exe 1144 spoolsv.exe 1696 spoolsv.exe 1696 spoolsv.exe 2040 spoolsv.exe 2040 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeexplorer.exedescription pid process target process PID 1680 wrote to memory of 2880 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe cmd.exe PID 1680 wrote to memory of 2880 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe cmd.exe PID 1680 wrote to memory of 2880 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe cmd.exe PID 1680 wrote to memory of 2880 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe cmd.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1680 wrote to memory of 1804 1680 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 2524 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 1804 wrote to memory of 1064 1804 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe diskperf.exe PID 2524 wrote to memory of 2288 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe explorer.exe PID 2524 wrote to memory of 2288 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe explorer.exe PID 2524 wrote to memory of 2288 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe explorer.exe PID 2524 wrote to memory of 2288 2524 368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe explorer.exe PID 2288 wrote to memory of 952 2288 explorer.exe cmd.exe PID 2288 wrote to memory of 952 2288 explorer.exe cmd.exe PID 2288 wrote to memory of 952 2288 explorer.exe cmd.exe PID 2288 wrote to memory of 952 2288 explorer.exe cmd.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe PID 2288 wrote to memory of 1604 2288 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe"C:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeC:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exeC:\Users\Admin\AppData\Local\Temp\368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:952 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1604 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2188 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1872
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:1560
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2300
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1716
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2772 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2292
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2480 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:676
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:984
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1316
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2324
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2276 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:936
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:884 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2696
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2208
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2716
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2804
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1688
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:1284 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2068
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:960
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2732
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2932 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:948
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1596
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2832
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:772 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1524
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2472
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:320 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2632
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2468 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1996
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:1508 -
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1992 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:580 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2468 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1992 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2104 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 369⤵
- Program crash
PID:1744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1856 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1272 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2684
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1524
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1568
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:940
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2656 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2448
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2124
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1064
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD507b5a07106b7195700141a74b6b9d765
SHA174330b396e102b57497498cc6db61d712a349d09
SHA256368acb5da3e3db13b409309c72faf01c28fc6b37b90f3dc092c47ab63e422010
SHA512ddb095ab64f69d2b977cc876c6d256e9e91a9b484b9407d326ea258494c7a2a295610108f2cb810feb5bb1720deec521d26c36398843565f32326133603b50d9
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5e0204036bea1b47349a56eef117b2c08
SHA16d8846ad266809409cf53eb45abfb251b0e3b477
SHA256172342da5a3dbe967d3d5fe16dcd58005cd42482ca8874bc717abc7ced96ed36
SHA512978fff14e334103918496226e108916cbaaac0aada86f3c7d9c913109cad4eaf82e096779a7cc410b3ac14aa097ba9d1119a91ad5866d58faf373c7c9884890e
-
Filesize
2.9MB
MD53a92d9c376cfc0c4835c891d561cf28e
SHA1e1a22314536a699d0de5680f7efe0a97d0d7f1d8
SHA256b977c2db4656d0b980a7780121ba2dfba52436483e85126b904e26313e3da7d8
SHA5120b0503b2abf7d69817233276a08cdcb0a459b1fc9139634d49aff1b1f7ea5588719d8506d4be606a7f7f4037d8df9f3634e18840989a2f2c0ae6c31737bed8fb