Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 04:25
Behavioral task
behavioral1
Sample
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
117cda2662205772c16f8b1e88dddfb9
-
SHA1
2cf2544d356ea2380bb37b77897157cc629ae562
-
SHA256
7d9343f796b3d76ae0570829eb54bba8fbcff40055edb53547c02ca34d38599a
-
SHA512
f627ccdd320d5fbf2603d58610c7a15031e4c0c4024826dd61092d0afd9632c33a4b2a8c7a93d93092e4a9bb0750b8c4d5c60f51ea6acf6380b2bbdefc6d5b61
-
SSDEEP
24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH9:3Ty7A3mw4gxeOw46fUbNecCCFbNecG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 41 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 764 explorer.exe 776 explorer.exe 952 explorer.exe 376 spoolsv.exe 1600 spoolsv.exe 2468 spoolsv.exe 2148 spoolsv.exe 1648 spoolsv.exe 1784 spoolsv.exe 1876 spoolsv.exe 2604 spoolsv.exe 788 spoolsv.exe 2032 spoolsv.exe 1884 spoolsv.exe 2120 spoolsv.exe 1192 spoolsv.exe 2360 spoolsv.exe 2876 spoolsv.exe 1700 spoolsv.exe 2748 spoolsv.exe 2648 spoolsv.exe 2428 spoolsv.exe 2396 spoolsv.exe 384 spoolsv.exe 2688 spoolsv.exe 1112 spoolsv.exe 688 spoolsv.exe 2104 spoolsv.exe 980 spoolsv.exe 1976 spoolsv.exe 1872 spoolsv.exe 1464 spoolsv.exe 1436 spoolsv.exe 2180 spoolsv.exe 2296 spoolsv.exe 2128 spoolsv.exe 2448 spoolsv.exe 2716 spoolsv.exe 1200 spoolsv.exe 1316 spoolsv.exe 812 spoolsv.exe 1004 spoolsv.exe 2776 spoolsv.exe 1972 spoolsv.exe 2856 spoolsv.exe 2956 spoolsv.exe 1712 spoolsv.exe 792 spoolsv.exe 2428 spoolsv.exe 2828 spoolsv.exe 2028 spoolsv.exe 324 spoolsv.exe 2008 spoolsv.exe 1664 spoolsv.exe 608 spoolsv.exe 2140 spoolsv.exe 2812 spoolsv.exe 2996 spoolsv.exe 2496 spoolsv.exe 2820 spoolsv.exe 2664 spoolsv.exe 1632 spoolsv.exe 2308 spoolsv.exe 1852 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 952 explorer.exe 952 explorer.exe 376 spoolsv.exe 952 explorer.exe 952 explorer.exe 2468 spoolsv.exe 952 explorer.exe 952 explorer.exe 1648 spoolsv.exe 952 explorer.exe 952 explorer.exe 1876 spoolsv.exe 952 explorer.exe 952 explorer.exe 788 spoolsv.exe 952 explorer.exe 952 explorer.exe 1884 spoolsv.exe 952 explorer.exe 952 explorer.exe 1192 spoolsv.exe 952 explorer.exe 952 explorer.exe 2876 spoolsv.exe 952 explorer.exe 952 explorer.exe 2748 spoolsv.exe 952 explorer.exe 952 explorer.exe 2428 spoolsv.exe 952 explorer.exe 952 explorer.exe 384 spoolsv.exe 952 explorer.exe 952 explorer.exe 1112 spoolsv.exe 952 explorer.exe 952 explorer.exe 2104 spoolsv.exe 952 explorer.exe 952 explorer.exe 1976 spoolsv.exe 952 explorer.exe 952 explorer.exe 1464 spoolsv.exe 952 explorer.exe 952 explorer.exe 2180 spoolsv.exe 952 explorer.exe 952 explorer.exe 2128 spoolsv.exe 952 explorer.exe 952 explorer.exe 2716 spoolsv.exe 952 explorer.exe 952 explorer.exe 1316 spoolsv.exe 952 explorer.exe 952 explorer.exe 1004 spoolsv.exe 952 explorer.exe 952 explorer.exe -
Adds Run key to start application 2 TTPs 17 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 2916 set thread context of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 set thread context of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 set thread context of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 764 set thread context of 776 764 explorer.exe explorer.exe PID 776 set thread context of 952 776 explorer.exe explorer.exe PID 776 set thread context of 2768 776 explorer.exe diskperf.exe PID 376 set thread context of 1600 376 spoolsv.exe spoolsv.exe PID 2468 set thread context of 2148 2468 spoolsv.exe spoolsv.exe PID 1648 set thread context of 1784 1648 spoolsv.exe spoolsv.exe PID 1876 set thread context of 2604 1876 spoolsv.exe spoolsv.exe PID 788 set thread context of 2032 788 spoolsv.exe spoolsv.exe PID 1884 set thread context of 2120 1884 spoolsv.exe spoolsv.exe PID 1192 set thread context of 2360 1192 spoolsv.exe spoolsv.exe PID 2876 set thread context of 1700 2876 spoolsv.exe spoolsv.exe PID 2748 set thread context of 2648 2748 spoolsv.exe spoolsv.exe PID 2428 set thread context of 2396 2428 spoolsv.exe spoolsv.exe PID 384 set thread context of 2688 384 spoolsv.exe spoolsv.exe PID 1112 set thread context of 688 1112 spoolsv.exe spoolsv.exe PID 2104 set thread context of 980 2104 spoolsv.exe spoolsv.exe PID 1976 set thread context of 1872 1976 spoolsv.exe spoolsv.exe PID 1464 set thread context of 1436 1464 spoolsv.exe spoolsv.exe PID 2180 set thread context of 2296 2180 spoolsv.exe spoolsv.exe PID 2128 set thread context of 2448 2128 spoolsv.exe spoolsv.exe PID 2716 set thread context of 1200 2716 spoolsv.exe spoolsv.exe PID 1316 set thread context of 812 1316 spoolsv.exe spoolsv.exe PID 1004 set thread context of 2776 1004 spoolsv.exe spoolsv.exe PID 1972 set thread context of 2856 1972 spoolsv.exe spoolsv.exe PID 2956 set thread context of 1712 2956 spoolsv.exe spoolsv.exe PID 792 set thread context of 2428 792 spoolsv.exe spoolsv.exe PID 2828 set thread context of 2028 2828 spoolsv.exe spoolsv.exe PID 324 set thread context of 2008 324 spoolsv.exe spoolsv.exe PID 1664 set thread context of 608 1664 spoolsv.exe spoolsv.exe PID 2140 set thread context of 2812 2140 spoolsv.exe spoolsv.exe PID 2996 set thread context of 2496 2996 spoolsv.exe spoolsv.exe PID 2820 set thread context of 2664 2820 spoolsv.exe spoolsv.exe PID 1632 set thread context of 2308 1632 spoolsv.exe spoolsv.exe PID 1852 set thread context of 2304 1852 spoolsv.exe spoolsv.exe PID 1736 set thread context of 2336 1736 spoolsv.exe spoolsv.exe PID 1428 set thread context of 2084 1428 spoolsv.exe spoolsv.exe PID 2072 set thread context of 2944 2072 spoolsv.exe spoolsv.exe PID 636 set thread context of 1996 636 spoolsv.exe spoolsv.exe PID 2212 set thread context of 2800 2212 spoolsv.exe spoolsv.exe PID 1600 set thread context of 760 1600 spoolsv.exe spoolsv.exe PID 1600 set thread context of 2728 1600 spoolsv.exe diskperf.exe PID 1564 set thread context of 1884 1564 spoolsv.exe spoolsv.exe PID 1888 set thread context of 2284 1888 explorer.exe explorer.exe PID 2024 set thread context of 932 2024 spoolsv.exe spoolsv.exe PID 1784 set thread context of 2744 1784 spoolsv.exe spoolsv.exe PID 1784 set thread context of 240 1784 spoolsv.exe diskperf.exe PID 2604 set thread context of 540 2604 spoolsv.exe spoolsv.exe PID 2604 set thread context of 2208 2604 spoolsv.exe diskperf.exe PID 2388 set thread context of 2400 2388 spoolsv.exe spoolsv.exe PID 2032 set thread context of 1512 2032 spoolsv.exe spoolsv.exe PID 2316 set thread context of 2852 2316 explorer.exe explorer.exe PID 2032 set thread context of 1696 2032 spoolsv.exe diskperf.exe PID 2472 set thread context of 1428 2472 spoolsv.exe spoolsv.exe PID 2120 set thread context of 2184 2120 spoolsv.exe spoolsv.exe PID 2120 set thread context of 2532 2120 spoolsv.exe diskperf.exe PID 1464 set thread context of 376 1464 spoolsv.exe spoolsv.exe PID 2360 set thread context of 2552 2360 spoolsv.exe spoolsv.exe PID 2360 set thread context of 1896 2360 spoolsv.exe diskperf.exe PID 2588 set thread context of 2576 2588 explorer.exe explorer.exe PID 2416 set thread context of 3048 2416 spoolsv.exe spoolsv.exe PID 1700 set thread context of 2036 1700 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 54 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 764 explorer.exe 376 spoolsv.exe 952 explorer.exe 952 explorer.exe 2468 spoolsv.exe 952 explorer.exe 1648 spoolsv.exe 952 explorer.exe 1876 spoolsv.exe 952 explorer.exe 788 spoolsv.exe 952 explorer.exe 1884 spoolsv.exe 952 explorer.exe 1192 spoolsv.exe 952 explorer.exe 2876 spoolsv.exe 952 explorer.exe 2748 spoolsv.exe 952 explorer.exe 2428 spoolsv.exe 952 explorer.exe 384 spoolsv.exe 952 explorer.exe 1112 spoolsv.exe 952 explorer.exe 2104 spoolsv.exe 952 explorer.exe 1976 spoolsv.exe 952 explorer.exe 1464 spoolsv.exe 952 explorer.exe 2180 spoolsv.exe 952 explorer.exe 2128 spoolsv.exe 952 explorer.exe 2716 spoolsv.exe 952 explorer.exe 1316 spoolsv.exe 952 explorer.exe 1004 spoolsv.exe 952 explorer.exe 1972 spoolsv.exe 952 explorer.exe 2956 spoolsv.exe 952 explorer.exe 792 spoolsv.exe 952 explorer.exe 2828 spoolsv.exe 952 explorer.exe 324 spoolsv.exe 952 explorer.exe 1664 spoolsv.exe 952 explorer.exe 2140 spoolsv.exe 952 explorer.exe 2996 spoolsv.exe 952 explorer.exe 2820 spoolsv.exe 952 explorer.exe 1632 spoolsv.exe 952 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 764 explorer.exe 764 explorer.exe 952 explorer.exe 952 explorer.exe 376 spoolsv.exe 376 spoolsv.exe 952 explorer.exe 952 explorer.exe 2468 spoolsv.exe 2468 spoolsv.exe 1648 spoolsv.exe 1648 spoolsv.exe 1876 spoolsv.exe 1876 spoolsv.exe 788 spoolsv.exe 788 spoolsv.exe 1884 spoolsv.exe 1884 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 2876 spoolsv.exe 2876 spoolsv.exe 2748 spoolsv.exe 2748 spoolsv.exe 2428 spoolsv.exe 2428 spoolsv.exe 384 spoolsv.exe 384 spoolsv.exe 1112 spoolsv.exe 1112 spoolsv.exe 2104 spoolsv.exe 2104 spoolsv.exe 1976 spoolsv.exe 1976 spoolsv.exe 1464 spoolsv.exe 1464 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 2128 spoolsv.exe 2128 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 1316 spoolsv.exe 1316 spoolsv.exe 1004 spoolsv.exe 1004 spoolsv.exe 1972 spoolsv.exe 1972 spoolsv.exe 2956 spoolsv.exe 2956 spoolsv.exe 792 spoolsv.exe 792 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 324 spoolsv.exe 324 spoolsv.exe 1664 spoolsv.exe 1664 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeexplorer.exedescription pid process target process PID 2916 wrote to memory of 2944 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe cmd.exe PID 2916 wrote to memory of 2944 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe cmd.exe PID 2916 wrote to memory of 2944 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe cmd.exe PID 2916 wrote to memory of 2944 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe cmd.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 2916 wrote to memory of 3024 2916 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2628 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 3024 wrote to memory of 2356 3024 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe diskperf.exe PID 2628 wrote to memory of 764 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe explorer.exe PID 2628 wrote to memory of 764 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe explorer.exe PID 2628 wrote to memory of 764 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe explorer.exe PID 2628 wrote to memory of 764 2628 117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe explorer.exe PID 764 wrote to memory of 1660 764 explorer.exe cmd.exe PID 764 wrote to memory of 1660 764 explorer.exe cmd.exe PID 764 wrote to memory of 1660 764 explorer.exe cmd.exe PID 764 wrote to memory of 1660 764 explorer.exe cmd.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe PID 764 wrote to memory of 776 764 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\117cda2662205772c16f8b1e88dddfb9_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:1660 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:776 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2084 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:760
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:696 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2284
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2728
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2736
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:816
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2744
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:384 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2852
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:540
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1512
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1312
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2184
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2876 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2576
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2532
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2552
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2036
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:912 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2844
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2948
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2880 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2616
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2688 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2176
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:1720 -
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:688 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:792
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:840 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2816
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1524 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2856 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:672 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:608 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2496 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2800
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2176
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3048
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2420 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1492
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2500
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2768
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:2356
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5117cda2662205772c16f8b1e88dddfb9
SHA12cf2544d356ea2380bb37b77897157cc629ae562
SHA2567d9343f796b3d76ae0570829eb54bba8fbcff40055edb53547c02ca34d38599a
SHA512f627ccdd320d5fbf2603d58610c7a15031e4c0c4024826dd61092d0afd9632c33a4b2a8c7a93d93092e4a9bb0750b8c4d5c60f51ea6acf6380b2bbdefc6d5b61
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
2.9MB
MD5ac9824dd32d17ea6f6cf860585b318ce
SHA1578c44d9535f3abb9ac714eadbd11183b40483e1
SHA256b8ff72e384542a11e62ba562c214c473d835c8c4dc34c6c77fa31a1f47990536
SHA51285fdb2b9fbc2aa5c3d6da405b3d59574b1107f02f2ae1ea58f2bb4601ff60aaa430a3e44aa4b404d01e2472348a9a779cd028b6f717ea5cc7758895ae0119ae4
-
Filesize
2.9MB
MD594db20cbb2e0dd00ee35ca74665d7061
SHA1d166983b22dcd4e7e9e13f966ae0a9d89ccaf9fe
SHA2563802f95852e2bbfb413a8a61213b8cb2ff12ad831bf2da4940d4b28ffdaec6b2
SHA512a40db3c0249eee6df5e5c1cbae52b2eff4d78f9a447eda39eccc82651e9e61b72c106aa32ab72b93e8af8401506c6fd131e1778820c6688621e166bc80c83602