Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 06:22
Behavioral task
behavioral1
Sample
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
c3f343dc0c85c7c69cddda419d8c05d0
-
SHA1
53db2f74bda7d4d384a9642df96bb6a01d5460f2
-
SHA256
e98ebc8c396a0e04671063ae02d112db7cc43360040380f48e49e75d5409d9f8
-
SHA512
0915abc02f12d6d4faf8fb37117079e441dd6cf5a9cc0c540b7fd8b0c49d9f70a333b2471f21121cfa0674cc51b77911710a94031e4859886d74c187793ee76c
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHp:7v97AXmw4gxeOw46fUbNecCCFbNec8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 27 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exepid process 1572 explorer.exe 1332 explorer.exe 1976 explorer.exe 1764 spoolsv.exe 284 spoolsv.exe 848 spoolsv.exe 1724 spoolsv.exe 2764 spoolsv.exe 2788 spoolsv.exe 2552 spoolsv.exe 2640 spoolsv.exe 1644 spoolsv.exe 2016 spoolsv.exe 1628 spoolsv.exe 2548 spoolsv.exe 2064 spoolsv.exe 2396 spoolsv.exe 2244 spoolsv.exe 1052 spoolsv.exe 540 spoolsv.exe 888 spoolsv.exe 2768 spoolsv.exe 2692 spoolsv.exe 2872 spoolsv.exe 2852 spoolsv.exe 808 spoolsv.exe 1668 spoolsv.exe 2576 spoolsv.exe 3048 spoolsv.exe 1340 spoolsv.exe 1536 spoolsv.exe 768 spoolsv.exe 564 spoolsv.exe 2160 spoolsv.exe 2652 spoolsv.exe 2320 spoolsv.exe 2840 spoolsv.exe 2748 spoolsv.exe 2560 spoolsv.exe 1480 spoolsv.exe 2708 spoolsv.exe 1808 spoolsv.exe 2912 spoolsv.exe 2084 spoolsv.exe 2152 spoolsv.exe 348 spoolsv.exe 2724 spoolsv.exe 2712 spoolsv.exe 2948 spoolsv.exe 2848 spoolsv.exe 2216 spoolsv.exe 560 spoolsv.exe 700 spoolsv.exe 2720 spoolsv.exe 2792 spoolsv.exe 1040 spoolsv.exe 1684 spoolsv.exe 768 spoolsv.exe 1680 explorer.exe 2984 spoolsv.exe 2732 spoolsv.exe 2936 explorer.exe 880 spoolsv.exe 300 explorer.exe -
Loads dropped DLL 64 IoCs
Processes:
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 1976 explorer.exe 1976 explorer.exe 1764 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 848 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2764 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2552 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 1644 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 1628 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2064 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2244 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 540 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2768 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2872 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 808 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2576 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 1340 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 768 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2160 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2320 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 2748 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 1480 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 1808 spoolsv.exe 1976 explorer.exe 1976 explorer.exe -
Adds Run key to start application 2 TTPs 15 IoCs
Processes:
spoolsv.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2476 set thread context of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 set thread context of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 set thread context of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1572 set thread context of 1332 1572 explorer.exe explorer.exe PID 1332 set thread context of 1976 1332 explorer.exe explorer.exe PID 1332 set thread context of 832 1332 explorer.exe diskperf.exe PID 1764 set thread context of 284 1764 spoolsv.exe spoolsv.exe PID 848 set thread context of 1724 848 spoolsv.exe spoolsv.exe PID 2764 set thread context of 2788 2764 spoolsv.exe spoolsv.exe PID 2552 set thread context of 2640 2552 spoolsv.exe spoolsv.exe PID 1644 set thread context of 2016 1644 spoolsv.exe spoolsv.exe PID 1628 set thread context of 2548 1628 spoolsv.exe spoolsv.exe PID 2064 set thread context of 2396 2064 spoolsv.exe spoolsv.exe PID 2244 set thread context of 1052 2244 spoolsv.exe spoolsv.exe PID 540 set thread context of 888 540 spoolsv.exe spoolsv.exe PID 2768 set thread context of 2692 2768 spoolsv.exe spoolsv.exe PID 2872 set thread context of 2852 2872 spoolsv.exe spoolsv.exe PID 808 set thread context of 1668 808 spoolsv.exe spoolsv.exe PID 2576 set thread context of 3048 2576 spoolsv.exe spoolsv.exe PID 1340 set thread context of 1536 1340 spoolsv.exe spoolsv.exe PID 768 set thread context of 564 768 spoolsv.exe spoolsv.exe PID 2160 set thread context of 2652 2160 spoolsv.exe spoolsv.exe PID 2320 set thread context of 2840 2320 spoolsv.exe spoolsv.exe PID 2748 set thread context of 2560 2748 spoolsv.exe spoolsv.exe PID 1480 set thread context of 2708 1480 spoolsv.exe spoolsv.exe PID 1808 set thread context of 2912 1808 spoolsv.exe spoolsv.exe PID 2084 set thread context of 2152 2084 spoolsv.exe spoolsv.exe PID 348 set thread context of 2724 348 spoolsv.exe spoolsv.exe PID 2712 set thread context of 2948 2712 spoolsv.exe spoolsv.exe PID 2848 set thread context of 2216 2848 spoolsv.exe spoolsv.exe PID 560 set thread context of 700 560 spoolsv.exe spoolsv.exe PID 2720 set thread context of 2792 2720 spoolsv.exe spoolsv.exe PID 1040 set thread context of 1684 1040 spoolsv.exe spoolsv.exe PID 284 set thread context of 768 284 spoolsv.exe spoolsv.exe PID 284 set thread context of 1116 284 spoolsv.exe diskperf.exe PID 1724 set thread context of 2732 1724 spoolsv.exe spoolsv.exe PID 1680 set thread context of 2936 1680 explorer.exe explorer.exe PID 1724 set thread context of 2556 1724 spoolsv.exe diskperf.exe PID 2788 set thread context of 880 2788 spoolsv.exe spoolsv.exe PID 2984 set thread context of 2088 2984 spoolsv.exe spoolsv.exe PID 2788 set thread context of 1200 2788 spoolsv.exe diskperf.exe PID 2640 set thread context of 2424 2640 spoolsv.exe spoolsv.exe PID 300 set thread context of 852 300 explorer.exe explorer.exe PID 2640 set thread context of 2156 2640 spoolsv.exe diskperf.exe PID 2016 set thread context of 1856 2016 spoolsv.exe spoolsv.exe PID 2016 set thread context of 2540 2016 spoolsv.exe diskperf.exe PID 800 set thread context of 892 800 spoolsv.exe spoolsv.exe PID 1660 set thread context of 2384 1660 explorer.exe explorer.exe PID 2548 set thread context of 2848 2548 spoolsv.exe spoolsv.exe PID 2548 set thread context of 1056 2548 spoolsv.exe diskperf.exe PID 2396 set thread context of 1244 2396 spoolsv.exe spoolsv.exe PID 2564 set thread context of 2432 2564 spoolsv.exe spoolsv.exe PID 2396 set thread context of 316 2396 spoolsv.exe diskperf.exe PID 1052 set thread context of 2812 1052 spoolsv.exe spoolsv.exe PID 1052 set thread context of 2976 1052 spoolsv.exe diskperf.exe PID 1316 set thread context of 916 1316 spoolsv.exe spoolsv.exe PID 2296 set thread context of 2980 2296 spoolsv.exe spoolsv.exe PID 1512 set thread context of 1768 1512 explorer.exe explorer.exe PID 888 set thread context of 1216 888 spoolsv.exe spoolsv.exe PID 2692 set thread context of 2768 2692 spoolsv.exe spoolsv.exe PID 888 set thread context of 2036 888 spoolsv.exe diskperf.exe PID 2692 set thread context of 1984 2692 spoolsv.exe diskperf.exe PID 2552 set thread context of 2544 2552 spoolsv.exe spoolsv.exe PID 2852 set thread context of 1340 2852 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 43 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exepid process 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 1572 explorer.exe 1764 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 848 spoolsv.exe 1976 explorer.exe 2764 spoolsv.exe 1976 explorer.exe 2552 spoolsv.exe 1976 explorer.exe 1644 spoolsv.exe 1976 explorer.exe 1628 spoolsv.exe 1976 explorer.exe 2064 spoolsv.exe 1976 explorer.exe 2244 spoolsv.exe 1976 explorer.exe 540 spoolsv.exe 1976 explorer.exe 2768 spoolsv.exe 1976 explorer.exe 2872 spoolsv.exe 1976 explorer.exe 808 spoolsv.exe 1976 explorer.exe 2576 spoolsv.exe 1976 explorer.exe 1340 spoolsv.exe 1976 explorer.exe 768 spoolsv.exe 1976 explorer.exe 2160 spoolsv.exe 1976 explorer.exe 2320 spoolsv.exe 1976 explorer.exe 2748 spoolsv.exe 1976 explorer.exe 1480 spoolsv.exe 1976 explorer.exe 1808 spoolsv.exe 1976 explorer.exe 2084 spoolsv.exe 1976 explorer.exe 348 spoolsv.exe 1976 explorer.exe 2712 spoolsv.exe 1976 explorer.exe 2848 spoolsv.exe 1976 explorer.exe 560 spoolsv.exe 1976 explorer.exe 2720 spoolsv.exe 1976 explorer.exe 1040 spoolsv.exe 1976 explorer.exe 2984 spoolsv.exe 1680 explorer.exe 300 explorer.exe 1976 explorer.exe 800 spoolsv.exe 1976 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe 1572 explorer.exe 1572 explorer.exe 1976 explorer.exe 1976 explorer.exe 1764 spoolsv.exe 1764 spoolsv.exe 1976 explorer.exe 1976 explorer.exe 848 spoolsv.exe 848 spoolsv.exe 2764 spoolsv.exe 2764 spoolsv.exe 2552 spoolsv.exe 2552 spoolsv.exe 1644 spoolsv.exe 1644 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe 2064 spoolsv.exe 2064 spoolsv.exe 2244 spoolsv.exe 2244 spoolsv.exe 540 spoolsv.exe 540 spoolsv.exe 2768 spoolsv.exe 2768 spoolsv.exe 2872 spoolsv.exe 2872 spoolsv.exe 808 spoolsv.exe 808 spoolsv.exe 2576 spoolsv.exe 2576 spoolsv.exe 1340 spoolsv.exe 1340 spoolsv.exe 768 spoolsv.exe 768 spoolsv.exe 2160 spoolsv.exe 2160 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe 2748 spoolsv.exe 2748 spoolsv.exe 1480 spoolsv.exe 1480 spoolsv.exe 1808 spoolsv.exe 1808 spoolsv.exe 2084 spoolsv.exe 2084 spoolsv.exe 348 spoolsv.exe 348 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 2848 spoolsv.exe 2848 spoolsv.exe 560 spoolsv.exe 560 spoolsv.exe 2720 spoolsv.exe 2720 spoolsv.exe 1040 spoolsv.exe 1040 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exec3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeexplorer.exedescription pid process target process PID 2476 wrote to memory of 2012 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe cmd.exe PID 2476 wrote to memory of 2012 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe cmd.exe PID 2476 wrote to memory of 2012 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe cmd.exe PID 2476 wrote to memory of 2012 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe cmd.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 2476 wrote to memory of 1432 2476 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2248 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 1432 wrote to memory of 2784 1432 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe diskperf.exe PID 2248 wrote to memory of 1572 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe explorer.exe PID 2248 wrote to memory of 1572 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe explorer.exe PID 2248 wrote to memory of 1572 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe explorer.exe PID 2248 wrote to memory of 1572 2248 c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe explorer.exe PID 1572 wrote to memory of 1952 1572 explorer.exe cmd.exe PID 1572 wrote to memory of 1952 1572 explorer.exe cmd.exe PID 1572 wrote to memory of 1952 1572 explorer.exe cmd.exe PID 1572 wrote to memory of 1952 1572 explorer.exe cmd.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe PID 1572 wrote to memory of 1332 1572 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeFilesize
2.9MB
MD5c3f343dc0c85c7c69cddda419d8c05d0
SHA153db2f74bda7d4d384a9642df96bb6a01d5460f2
SHA256e98ebc8c396a0e04671063ae02d112db7cc43360040380f48e49e75d5409d9f8
SHA5120915abc02f12d6d4faf8fb37117079e441dd6cf5a9cc0c540b7fd8b0c49d9f70a333b2471f21121cfa0674cc51b77911710a94031e4859886d74c187793ee76c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
\Windows\system\explorer.exeFilesize
2.9MB
MD57cdfefb3e4cc4010d40a6b61e8cfc059
SHA13f0d29ff00285952a9c60b044ba4b0f0f75bded1
SHA2562480027dec886b70c89d156cb92f90e880f008d0b06f12c9adff037b047c6ff3
SHA512335710f6af221c5f0bb6c0dd02c0adf99469fab9a8a061636bc48f759397b974d0637f5e14442a3f7f745c3e0acd1850fea53f6d9f750516b1f535eeba41bab3
-
\Windows\system\spoolsv.exeFilesize
2.9MB
MD5fc58fa9ea95343afb27bf213d60bb4cb
SHA1167e8d98ccdb30b450d7e1a2d8870ebb1bfff7a7
SHA25684a49a1e79f46c1c5baaec9ab58c8c0103ac9d20f6ef59ab88e3869f6f8af640
SHA512649c786ec9315b2df4e0f3ad3105477b89941b490d71da43bf8ba72c410c78e7a15992da2d824cbffe209a565007347a76f0a95334034a62511db39e7aa18710
-
memory/284-1531-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/284-238-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/564-930-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/700-1417-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/888-638-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/888-2187-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1052-588-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/1052-1986-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/1332-176-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1332-142-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-13-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-20-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-17-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-15-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-1-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/1432-11-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-9-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-43-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-41-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-39-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-28-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-27-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-18-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-2-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-7-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-42-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-46-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-44-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-45-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-79-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1432-47-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/1432-22-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-4-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-40-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-24-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-30-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1432-35-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1432-37-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1536-883-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1724-280-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1724-1643-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2016-433-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2016-1790-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2152-1220-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2216-1365-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2248-60-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2248-54-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2248-66-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2248-56-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2248-141-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2248-52-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2396-1959-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2396-540-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2548-489-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2548-1918-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2560-1078-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2640-383-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2640-1741-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2652-980-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2692-2177-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2692-693-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2708-1126-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2724-1271-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2784-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2784-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2788-1680-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2840-1027-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2852-743-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-1319-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3048-834-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB