Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 21:34
Behavioral task
behavioral1
Sample
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
Resource
win10v2004-20240419-en
General
-
Target
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe
-
Size
2.9MB
-
MD5
6152aa2ac9f13e528d29264bacfafcc5
-
SHA1
e96252bddfcd18be20123d26d5224e6b4014cea2
-
SHA256
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b
-
SHA512
c191d41a948d90d9ba1165cc23509c9ed94c3a022edbb69380b0b9c71ab57dd224126784a1d4ba0d241ad06e2bfee5d43a58ab8fc517f1342b39cddc172d203d
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHG:7v97AXmw4gxeOw46fUbNecCCFbNecT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack 45 IoCs
Processes:
resource yara_rule behavioral1/memory/1840-6-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-4-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-47-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-48-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-45-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-44-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-43-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-40-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-39-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-34-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-30-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-28-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-26-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-24-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-22-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-20-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-18-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-16-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-10-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-8-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-46-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-42-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-41-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-37-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-14-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-12-0x0000000000400000-0x0000000001400000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1840-81-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2992-142-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2992-177-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1884-239-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2900-291-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1940-339-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2952-389-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/324-439-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2016-490-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2168-545-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2288-596-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1884-1635-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2900-1750-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1940-1818-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2952-1889-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/324-2045-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2016-2120-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2288-2320-0x0000000000400000-0x0000000000628000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2168-2371-0x0000000000400000-0x0000000001990000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 24 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1696 explorer.exe 2992 explorer.exe 1872 explorer.exe 1364 spoolsv.exe 1884 spoolsv.exe 896 spoolsv.exe 2900 spoolsv.exe 2736 spoolsv.exe 1940 spoolsv.exe 2504 spoolsv.exe 2952 spoolsv.exe 1596 spoolsv.exe 324 spoolsv.exe 2688 spoolsv.exe 2016 spoolsv.exe 1704 spoolsv.exe 2168 spoolsv.exe 1016 spoolsv.exe 2288 spoolsv.exe 1608 spoolsv.exe 2388 spoolsv.exe 2488 spoolsv.exe 2748 spoolsv.exe 2088 spoolsv.exe 2200 spoolsv.exe 492 spoolsv.exe 1600 spoolsv.exe 3060 spoolsv.exe 1496 spoolsv.exe 996 spoolsv.exe 2352 spoolsv.exe 2408 spoolsv.exe 2228 spoolsv.exe 2852 spoolsv.exe 2080 spoolsv.exe 2488 spoolsv.exe 2964 spoolsv.exe 1032 spoolsv.exe 2796 spoolsv.exe 1152 spoolsv.exe 2324 spoolsv.exe 2444 spoolsv.exe 2356 spoolsv.exe 1520 spoolsv.exe 2396 spoolsv.exe 1312 spoolsv.exe 2632 spoolsv.exe 2612 spoolsv.exe 2588 spoolsv.exe 1096 spoolsv.exe 2944 spoolsv.exe 2820 spoolsv.exe 956 spoolsv.exe 1204 spoolsv.exe 2816 spoolsv.exe 2808 spoolsv.exe 1704 spoolsv.exe 2372 spoolsv.exe 2148 spoolsv.exe 2660 spoolsv.exe 1744 spoolsv.exe 2772 spoolsv.exe 340 spoolsv.exe 1516 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 1872 explorer.exe 1872 explorer.exe 1364 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 896 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2736 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2504 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1596 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2688 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1704 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1016 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1608 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2488 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2088 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 492 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 3060 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 996 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2408 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2852 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2488 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1032 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 1152 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 2444 spoolsv.exe 1872 explorer.exe 1872 explorer.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2208 set thread context of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 set thread context of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 set thread context of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1696 set thread context of 2992 1696 explorer.exe explorer.exe PID 2992 set thread context of 1872 2992 explorer.exe explorer.exe PID 2992 set thread context of 1092 2992 explorer.exe diskperf.exe PID 1364 set thread context of 1884 1364 spoolsv.exe spoolsv.exe PID 896 set thread context of 2900 896 spoolsv.exe spoolsv.exe PID 2736 set thread context of 1940 2736 spoolsv.exe spoolsv.exe PID 2504 set thread context of 2952 2504 spoolsv.exe spoolsv.exe PID 1596 set thread context of 324 1596 spoolsv.exe spoolsv.exe PID 2688 set thread context of 2016 2688 spoolsv.exe spoolsv.exe PID 1704 set thread context of 2168 1704 spoolsv.exe spoolsv.exe PID 1016 set thread context of 2288 1016 spoolsv.exe spoolsv.exe PID 1608 set thread context of 2388 1608 spoolsv.exe spoolsv.exe PID 2488 set thread context of 2748 2488 spoolsv.exe spoolsv.exe PID 2088 set thread context of 2200 2088 spoolsv.exe spoolsv.exe PID 492 set thread context of 1600 492 spoolsv.exe spoolsv.exe PID 3060 set thread context of 1496 3060 spoolsv.exe spoolsv.exe PID 996 set thread context of 2352 996 spoolsv.exe spoolsv.exe PID 2408 set thread context of 2228 2408 spoolsv.exe spoolsv.exe PID 2852 set thread context of 2080 2852 spoolsv.exe spoolsv.exe PID 2488 set thread context of 2964 2488 spoolsv.exe spoolsv.exe PID 1032 set thread context of 2796 1032 spoolsv.exe spoolsv.exe PID 1152 set thread context of 2324 1152 spoolsv.exe spoolsv.exe PID 2444 set thread context of 2356 2444 spoolsv.exe spoolsv.exe PID 1520 set thread context of 2396 1520 spoolsv.exe spoolsv.exe PID 1312 set thread context of 2632 1312 spoolsv.exe spoolsv.exe PID 2612 set thread context of 2588 2612 spoolsv.exe spoolsv.exe PID 1096 set thread context of 2944 1096 spoolsv.exe spoolsv.exe PID 2820 set thread context of 956 2820 spoolsv.exe spoolsv.exe PID 1204 set thread context of 2816 1204 spoolsv.exe spoolsv.exe PID 2808 set thread context of 1704 2808 spoolsv.exe spoolsv.exe PID 2372 set thread context of 2148 2372 spoolsv.exe spoolsv.exe PID 2660 set thread context of 1744 2660 spoolsv.exe spoolsv.exe PID 2772 set thread context of 1516 2772 spoolsv.exe spoolsv.exe PID 1884 set thread context of 1536 1884 spoolsv.exe spoolsv.exe PID 1884 set thread context of 2708 1884 spoolsv.exe diskperf.exe PID 340 set thread context of 1652 340 spoolsv.exe spoolsv.exe PID 2900 set thread context of 1968 2900 spoolsv.exe spoolsv.exe PID 568 set thread context of 2416 568 spoolsv.exe spoolsv.exe PID 2900 set thread context of 1432 2900 spoolsv.exe diskperf.exe PID 792 set thread context of 2180 792 explorer.exe explorer.exe PID 1940 set thread context of 2888 1940 spoolsv.exe spoolsv.exe PID 1940 set thread context of 1764 1940 spoolsv.exe diskperf.exe PID 2484 set thread context of 2812 2484 spoolsv.exe spoolsv.exe PID 2952 set thread context of 284 2952 spoolsv.exe spoolsv.exe PID 2952 set thread context of 2476 2952 spoolsv.exe diskperf.exe PID 1700 set thread context of 2504 1700 spoolsv.exe spoolsv.exe PID 2084 set thread context of 1668 2084 explorer.exe explorer.exe PID 324 set thread context of 544 324 spoolsv.exe spoolsv.exe PID 324 set thread context of 2368 324 spoolsv.exe diskperf.exe PID 1584 set thread context of 456 1584 spoolsv.exe spoolsv.exe PID 2016 set thread context of 1988 2016 spoolsv.exe spoolsv.exe PID 2016 set thread context of 1136 2016 spoolsv.exe diskperf.exe PID 896 set thread context of 2480 896 spoolsv.exe spoolsv.exe PID 2972 set thread context of 2272 2972 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 44 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 1696 explorer.exe 1364 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 896 spoolsv.exe 1872 explorer.exe 2736 spoolsv.exe 1872 explorer.exe 2504 spoolsv.exe 1872 explorer.exe 1596 spoolsv.exe 1872 explorer.exe 2688 spoolsv.exe 1872 explorer.exe 1704 spoolsv.exe 1872 explorer.exe 1016 spoolsv.exe 1872 explorer.exe 1608 spoolsv.exe 1872 explorer.exe 2488 spoolsv.exe 1872 explorer.exe 2088 spoolsv.exe 1872 explorer.exe 492 spoolsv.exe 1872 explorer.exe 3060 spoolsv.exe 1872 explorer.exe 996 spoolsv.exe 1872 explorer.exe 2408 spoolsv.exe 1872 explorer.exe 2852 spoolsv.exe 1872 explorer.exe 2488 spoolsv.exe 1872 explorer.exe 1032 spoolsv.exe 1872 explorer.exe 1152 spoolsv.exe 1872 explorer.exe 2444 spoolsv.exe 1872 explorer.exe 1520 spoolsv.exe 1872 explorer.exe 1312 spoolsv.exe 1872 explorer.exe 2612 spoolsv.exe 1872 explorer.exe 1096 spoolsv.exe 1872 explorer.exe 2820 spoolsv.exe 1872 explorer.exe 1204 spoolsv.exe 1872 explorer.exe 2808 spoolsv.exe 1872 explorer.exe 2372 spoolsv.exe 1872 explorer.exe 2660 spoolsv.exe 1872 explorer.exe 2772 spoolsv.exe 1872 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 1696 explorer.exe 1696 explorer.exe 1872 explorer.exe 1872 explorer.exe 1364 spoolsv.exe 1364 spoolsv.exe 1872 explorer.exe 1872 explorer.exe 896 spoolsv.exe 896 spoolsv.exe 2736 spoolsv.exe 2736 spoolsv.exe 2504 spoolsv.exe 2504 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 2688 spoolsv.exe 2688 spoolsv.exe 1704 spoolsv.exe 1704 spoolsv.exe 1016 spoolsv.exe 1016 spoolsv.exe 1608 spoolsv.exe 1608 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 2088 spoolsv.exe 2088 spoolsv.exe 492 spoolsv.exe 492 spoolsv.exe 3060 spoolsv.exe 3060 spoolsv.exe 996 spoolsv.exe 996 spoolsv.exe 2408 spoolsv.exe 2408 spoolsv.exe 2852 spoolsv.exe 2852 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 1032 spoolsv.exe 1032 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 2444 spoolsv.exe 2444 spoolsv.exe 1520 spoolsv.exe 1520 spoolsv.exe 1312 spoolsv.exe 1312 spoolsv.exe 2612 spoolsv.exe 2612 spoolsv.exe 1096 spoolsv.exe 1096 spoolsv.exe 2820 spoolsv.exe 2820 spoolsv.exe 1204 spoolsv.exe 1204 spoolsv.exe 2808 spoolsv.exe 2808 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeexplorer.exedescription pid process target process PID 2208 wrote to memory of 2000 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 2208 wrote to memory of 2000 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 2208 wrote to memory of 2000 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 2208 wrote to memory of 2000 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe cmd.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 2208 wrote to memory of 1840 2208 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 2932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 1840 wrote to memory of 1932 1840 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe diskperf.exe PID 2932 wrote to memory of 1696 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 2932 wrote to memory of 1696 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 2932 wrote to memory of 1696 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 2932 wrote to memory of 1696 2932 4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe explorer.exe PID 1696 wrote to memory of 324 1696 explorer.exe cmd.exe PID 1696 wrote to memory of 324 1696 explorer.exe cmd.exe PID 1696 wrote to memory of 324 1696 explorer.exe cmd.exe PID 1696 wrote to memory of 324 1696 explorer.exe cmd.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe PID 1696 wrote to memory of 2992 1696 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe"C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeC:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exeC:\Users\Admin\AppData\Local\Temp\4c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:324 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2992 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1536
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:544 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2180
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1968
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2888
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:284
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:892 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1668
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:544
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1780
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1988
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:2464 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1008
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2168 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1036
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1628
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2288 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1968
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2028
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2652
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1752
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2388 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1736
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1804
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1496 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2652 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1936
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2916 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2632 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2524 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2116 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2416
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2628 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2812
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1820 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2788
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2636
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:1092
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD56152aa2ac9f13e528d29264bacfafcc5
SHA1e96252bddfcd18be20123d26d5224e6b4014cea2
SHA2564c7e7c10884277db2755a855da5686fed2216947bfe980c6051c7185a9305b9b
SHA512c191d41a948d90d9ba1165cc23509c9ed94c3a022edbb69380b0b9c71ab57dd224126784a1d4ba0d241ad06e2bfee5d43a58ab8fc517f1342b39cddc172d203d
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
2.9MB
MD5e36a01774b8c128d1df94fc628c5e04f
SHA13ea4488cd4f2a0c8185c4d96f0270195fe92b641
SHA256dbf9693546701c7b35a349ab642c592a2be5e0e8875e897004f9d5e0439d0d7f
SHA5122443803991e6811cc35ea75df3be22b296c91335d79d3f865ebb148b94ff461ad261424debd77b4ce7cc0a9607f351c8ee4233879f05a9cc4eed030db136e346
-
Filesize
2.9MB
MD5441eee6a93627d165abbf8d3fbcf2f05
SHA10accaaf07105cd8c012882689c10ea17e82fd38e
SHA25691c9fd2c5eef48a5d3bd295bbba39a0511d5a7de472c9d6565c87aa2c4710560
SHA512223adb211de28ab7d71fab5d8ec2ba3773dae8e270e2fb59c1fe80fec31c1ffc7a8639763802ce1e6373f500cbf2689916f60f3b6990d1768efbd3cfa3f894af