Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 07:59
Behavioral task
behavioral1
Sample
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
568492459c6bcca3ac14b3c199953790
-
SHA1
e25a3a631715c8a4274beb34e7e8b8d86f32b153
-
SHA256
47310f6323cf57d5bed3a4b3975a951b9aad2ed4eff98ab55fa2ef7389790543
-
SHA512
0e15ca4b041dd762c4448f16b3d3aae296cd0cdb7d402a1442ec6600839035e1b8735e481af4cba9bae5b842be304c75df4ad91961aa003b03a589d33c90669d
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH/:ATU7AAmw4gxeOw46fUbNecCCFbNecQ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 30 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 2192 explorer.exe 2500 explorer.exe 840 explorer.exe 968 spoolsv.exe 1172 spoolsv.exe 2140 spoolsv.exe 2044 spoolsv.exe 3000 spoolsv.exe 2592 spoolsv.exe 2864 spoolsv.exe 2180 spoolsv.exe 2420 spoolsv.exe 2756 spoolsv.exe 492 spoolsv.exe 1464 spoolsv.exe 1776 spoolsv.exe 2088 spoolsv.exe 2944 spoolsv.exe 3024 spoolsv.exe 2332 spoolsv.exe 2884 spoolsv.exe 2496 spoolsv.exe 1596 spoolsv.exe 2760 spoolsv.exe 2244 spoolsv.exe 1904 spoolsv.exe 2092 spoolsv.exe 2800 spoolsv.exe 1756 spoolsv.exe 972 spoolsv.exe 2072 spoolsv.exe 2940 spoolsv.exe 2524 spoolsv.exe 2520 spoolsv.exe 2448 spoolsv.exe 1784 spoolsv.exe 1076 spoolsv.exe 588 spoolsv.exe 2492 spoolsv.exe 2364 spoolsv.exe 2880 spoolsv.exe 1612 spoolsv.exe 2972 spoolsv.exe 1484 spoolsv.exe 2540 spoolsv.exe 2440 spoolsv.exe 2568 spoolsv.exe 1672 spoolsv.exe 1824 spoolsv.exe 1828 spoolsv.exe 2548 spoolsv.exe 1812 spoolsv.exe 2460 spoolsv.exe 1632 spoolsv.exe 1456 spoolsv.exe 2860 spoolsv.exe 972 spoolsv.exe 2920 spoolsv.exe 2664 spoolsv.exe 1268 spoolsv.exe 2204 spoolsv.exe 1896 spoolsv.exe 2256 spoolsv.exe 2712 explorer.exe -
Loads dropped DLL 64 IoCs
Processes:
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 840 explorer.exe 840 explorer.exe 968 spoolsv.exe 840 explorer.exe 840 explorer.exe 2140 spoolsv.exe 840 explorer.exe 840 explorer.exe 3000 spoolsv.exe 840 explorer.exe 840 explorer.exe 2864 spoolsv.exe 840 explorer.exe 840 explorer.exe 2420 spoolsv.exe 840 explorer.exe 840 explorer.exe 492 spoolsv.exe 840 explorer.exe 840 explorer.exe 1776 spoolsv.exe 840 explorer.exe 840 explorer.exe 2944 spoolsv.exe 840 explorer.exe 840 explorer.exe 2332 spoolsv.exe 840 explorer.exe 840 explorer.exe 2496 spoolsv.exe 840 explorer.exe 840 explorer.exe 2760 spoolsv.exe 840 explorer.exe 840 explorer.exe 1904 spoolsv.exe 840 explorer.exe 840 explorer.exe 2800 spoolsv.exe 840 explorer.exe 840 explorer.exe 972 spoolsv.exe 840 explorer.exe 840 explorer.exe 2940 spoolsv.exe 840 explorer.exe 840 explorer.exe 2520 spoolsv.exe 840 explorer.exe 840 explorer.exe 1784 spoolsv.exe 840 explorer.exe 840 explorer.exe 588 spoolsv.exe 840 explorer.exe 840 explorer.exe 2364 spoolsv.exe 840 explorer.exe 840 explorer.exe 1612 spoolsv.exe 840 explorer.exe 840 explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1848-44-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Windows\system\explorer.exe upx behavioral1/memory/2192-102-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe upx \Windows\system\spoolsv.exe upx behavioral1/memory/968-244-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2140-254-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/3000-307-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2864-361-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2420-414-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/492-467-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1776-520-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/840-574-0x00000000024E0000-0x0000000002526000-memory.dmp upx behavioral1/memory/2944-575-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/840-573-0x00000000024E0000-0x0000000002526000-memory.dmp upx behavioral1/memory/2332-631-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2496-686-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/840-736-0x00000000024E0000-0x0000000002526000-memory.dmp upx behavioral1/memory/2760-738-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 15 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1848 set thread context of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 set thread context of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 set thread context of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2192 set thread context of 2500 2192 explorer.exe explorer.exe PID 2500 set thread context of 840 2500 explorer.exe explorer.exe PID 2500 set thread context of 1480 2500 explorer.exe diskperf.exe PID 968 set thread context of 1172 968 spoolsv.exe spoolsv.exe PID 2140 set thread context of 2044 2140 spoolsv.exe spoolsv.exe PID 3000 set thread context of 2592 3000 spoolsv.exe spoolsv.exe PID 2864 set thread context of 2180 2864 spoolsv.exe spoolsv.exe PID 2420 set thread context of 2756 2420 spoolsv.exe spoolsv.exe PID 492 set thread context of 1464 492 spoolsv.exe spoolsv.exe PID 1776 set thread context of 2088 1776 spoolsv.exe spoolsv.exe PID 2944 set thread context of 3024 2944 spoolsv.exe spoolsv.exe PID 2332 set thread context of 2884 2332 spoolsv.exe spoolsv.exe PID 2496 set thread context of 1596 2496 spoolsv.exe spoolsv.exe PID 2760 set thread context of 2244 2760 spoolsv.exe spoolsv.exe PID 1904 set thread context of 2092 1904 spoolsv.exe spoolsv.exe PID 2800 set thread context of 1756 2800 spoolsv.exe spoolsv.exe PID 972 set thread context of 2072 972 spoolsv.exe spoolsv.exe PID 2940 set thread context of 2524 2940 spoolsv.exe spoolsv.exe PID 2520 set thread context of 2448 2520 spoolsv.exe spoolsv.exe PID 1784 set thread context of 1076 1784 spoolsv.exe spoolsv.exe PID 588 set thread context of 2492 588 spoolsv.exe spoolsv.exe PID 2364 set thread context of 2880 2364 spoolsv.exe spoolsv.exe PID 1612 set thread context of 2972 1612 spoolsv.exe spoolsv.exe PID 1484 set thread context of 2540 1484 spoolsv.exe spoolsv.exe PID 2440 set thread context of 2568 2440 spoolsv.exe spoolsv.exe PID 1672 set thread context of 1824 1672 spoolsv.exe spoolsv.exe PID 1828 set thread context of 2548 1828 spoolsv.exe spoolsv.exe PID 1812 set thread context of 2460 1812 spoolsv.exe spoolsv.exe PID 1632 set thread context of 1456 1632 spoolsv.exe spoolsv.exe PID 2860 set thread context of 972 2860 spoolsv.exe spoolsv.exe PID 2920 set thread context of 2664 2920 spoolsv.exe spoolsv.exe PID 1268 set thread context of 2204 1268 spoolsv.exe spoolsv.exe PID 1172 set thread context of 2256 1172 spoolsv.exe spoolsv.exe PID 1172 set thread context of 1420 1172 spoolsv.exe diskperf.exe PID 1896 set thread context of 2532 1896 spoolsv.exe spoolsv.exe PID 2044 set thread context of 776 2044 spoolsv.exe spoolsv.exe PID 2712 set thread context of 1504 2712 explorer.exe explorer.exe PID 2044 set thread context of 1236 2044 spoolsv.exe diskperf.exe PID 1328 set thread context of 2944 1328 spoolsv.exe spoolsv.exe PID 2592 set thread context of 2636 2592 spoolsv.exe spoolsv.exe PID 2592 set thread context of 2588 2592 spoolsv.exe diskperf.exe PID 2676 set thread context of 112 2676 spoolsv.exe spoolsv.exe PID 2180 set thread context of 1572 2180 spoolsv.exe spoolsv.exe PID 2180 set thread context of 2176 2180 spoolsv.exe diskperf.exe PID 860 set thread context of 928 860 explorer.exe explorer.exe PID 2756 set thread context of 2068 2756 spoolsv.exe spoolsv.exe PID 2756 set thread context of 936 2756 spoolsv.exe diskperf.exe PID 2552 set thread context of 1860 2552 spoolsv.exe spoolsv.exe PID 1464 set thread context of 1192 1464 spoolsv.exe spoolsv.exe PID 1464 set thread context of 2080 1464 spoolsv.exe diskperf.exe PID 1688 set thread context of 2084 1688 explorer.exe explorer.exe PID 2380 set thread context of 1680 2380 spoolsv.exe spoolsv.exe PID 2088 set thread context of 1732 2088 spoolsv.exe spoolsv.exe PID 2088 set thread context of 2452 2088 spoolsv.exe diskperf.exe PID 3024 set thread context of 308 3024 spoolsv.exe spoolsv.exe PID 3024 set thread context of 908 3024 spoolsv.exe diskperf.exe PID 2760 set thread context of 1092 2760 explorer.exe explorer.exe PID 1640 set thread context of 1424 1640 spoolsv.exe spoolsv.exe PID 2884 set thread context of 2056 2884 spoolsv.exe spoolsv.exe PID 2884 set thread context of 2584 2884 spoolsv.exe diskperf.exe PID 1596 set thread context of 2792 1596 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 45 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2192 explorer.exe 968 spoolsv.exe 840 explorer.exe 840 explorer.exe 2140 spoolsv.exe 840 explorer.exe 3000 spoolsv.exe 840 explorer.exe 2864 spoolsv.exe 840 explorer.exe 2420 spoolsv.exe 840 explorer.exe 492 spoolsv.exe 840 explorer.exe 1776 spoolsv.exe 840 explorer.exe 2944 spoolsv.exe 840 explorer.exe 2332 spoolsv.exe 840 explorer.exe 2496 spoolsv.exe 840 explorer.exe 2760 spoolsv.exe 840 explorer.exe 1904 spoolsv.exe 840 explorer.exe 2800 spoolsv.exe 840 explorer.exe 972 spoolsv.exe 840 explorer.exe 2940 spoolsv.exe 840 explorer.exe 2520 spoolsv.exe 840 explorer.exe 1784 spoolsv.exe 840 explorer.exe 588 spoolsv.exe 840 explorer.exe 2364 spoolsv.exe 840 explorer.exe 1612 spoolsv.exe 840 explorer.exe 1484 spoolsv.exe 840 explorer.exe 2440 spoolsv.exe 840 explorer.exe 1672 spoolsv.exe 840 explorer.exe 1828 spoolsv.exe 840 explorer.exe 1812 spoolsv.exe 840 explorer.exe 1632 spoolsv.exe 840 explorer.exe 2860 spoolsv.exe 840 explorer.exe 2920 spoolsv.exe 840 explorer.exe 1268 spoolsv.exe 840 explorer.exe 1896 spoolsv.exe 2712 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 2192 explorer.exe 2192 explorer.exe 840 explorer.exe 840 explorer.exe 968 spoolsv.exe 968 spoolsv.exe 840 explorer.exe 840 explorer.exe 2140 spoolsv.exe 2140 spoolsv.exe 3000 spoolsv.exe 3000 spoolsv.exe 2864 spoolsv.exe 2864 spoolsv.exe 2420 spoolsv.exe 2420 spoolsv.exe 492 spoolsv.exe 492 spoolsv.exe 1776 spoolsv.exe 1776 spoolsv.exe 2944 spoolsv.exe 2944 spoolsv.exe 2332 spoolsv.exe 2332 spoolsv.exe 2496 spoolsv.exe 2496 spoolsv.exe 2760 spoolsv.exe 2760 spoolsv.exe 1904 spoolsv.exe 1904 spoolsv.exe 2800 spoolsv.exe 2800 spoolsv.exe 972 spoolsv.exe 972 spoolsv.exe 2940 spoolsv.exe 2940 spoolsv.exe 2520 spoolsv.exe 2520 spoolsv.exe 1784 spoolsv.exe 1784 spoolsv.exe 588 spoolsv.exe 588 spoolsv.exe 2364 spoolsv.exe 2364 spoolsv.exe 1612 spoolsv.exe 1612 spoolsv.exe 1484 spoolsv.exe 1484 spoolsv.exe 2440 spoolsv.exe 2440 spoolsv.exe 1672 spoolsv.exe 1672 spoolsv.exe 1828 spoolsv.exe 1828 spoolsv.exe 1812 spoolsv.exe 1812 spoolsv.exe 1632 spoolsv.exe 1632 spoolsv.exe 2860 spoolsv.exe 2860 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeexplorer.exedescription pid process target process PID 1848 wrote to memory of 3052 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe cmd.exe PID 1848 wrote to memory of 3052 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe cmd.exe PID 1848 wrote to memory of 3052 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe cmd.exe PID 1848 wrote to memory of 3052 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe cmd.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 1848 wrote to memory of 2128 1848 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 2752 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2128 wrote to memory of 1604 2128 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe diskperf.exe PID 2752 wrote to memory of 2192 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe explorer.exe PID 2752 wrote to memory of 2192 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe explorer.exe PID 2752 wrote to memory of 2192 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe explorer.exe PID 2752 wrote to memory of 2192 2752 568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe explorer.exe PID 2192 wrote to memory of 1716 2192 explorer.exe cmd.exe PID 2192 wrote to memory of 1716 2192 explorer.exe cmd.exe PID 2192 wrote to memory of 1716 2192 explorer.exe cmd.exe PID 2192 wrote to memory of 1716 2192 explorer.exe cmd.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe PID 2192 wrote to memory of 2500 2192 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\568492459c6bcca3ac14b3c199953790_NeikiAnalytics.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeFilesize
2.9MB
MD5568492459c6bcca3ac14b3c199953790
SHA1e25a3a631715c8a4274beb34e7e8b8d86f32b153
SHA25647310f6323cf57d5bed3a4b3975a951b9aad2ed4eff98ab55fa2ef7389790543
SHA5120e15ca4b041dd762c4448f16b3d3aae296cd0cdb7d402a1442ec6600839035e1b8735e481af4cba9bae5b842be304c75df4ad91961aa003b03a589d33c90669d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\system\explorer.exeFilesize
2.9MB
MD56c3da61b67c4fe76b397485a756d0ea8
SHA1eaaa5c54b420541903507f95295247ba3e6cfe2a
SHA2569f3ff7b5d355743515fdfc4f66327be257d003c9116003c52d3afd79dc69b0c3
SHA5122f2199b9a257250dd0ad33212eda8d4bb49d74afe5669752b73db443161822e801991e2ea78b14309e9f9a34ec8fb95ac243e49a091274f7905a979b72f0e208
-
\Windows\system\spoolsv.exeFilesize
2.9MB
MD5cb3a703da019b20a7579291228ad89a5
SHA19be4e44cc3353c6ade857d6ebd0e8cb7d732b323
SHA2564ce2a421cf027f233bd604f1b3d989d6dae6fa86049eab85a340cfdcddfe0f88
SHA512ab81e3ed82334bea0d91eb0a48ccabbb240f970cce00d1900746591b1fd6bd01d682e7e733906fdcbe998723e2401678eb4963e5550bc74292eb8d9454d2fabe
-
memory/492-467-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/840-629-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-684-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-196-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-2322-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-2321-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-305-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-360-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-428-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-1253-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-879-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-880-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-427-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-574-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-737-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-735-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-736-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-573-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/840-630-0x00000000024E0000-0x0000000002526000-memory.dmpFilesize
280KB
-
memory/968-202-0x0000000000450000-0x0000000000496000-memory.dmpFilesize
280KB
-
memory/968-244-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1172-253-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1172-1653-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1464-2066-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1464-519-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1596-733-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1596-2387-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1604-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1776-520-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1848-44-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1848-0-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2044-302-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2044-1770-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2088-561-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2088-2184-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2128-53-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-17-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-50-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-33-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-52-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-51-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-22-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-54-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-47-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-24-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-43-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-13-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-49-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/2128-8-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-75-0x0000000007270000-0x00000000072B6000-memory.dmpFilesize
280KB
-
memory/2128-48-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-89-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-45-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-46-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-42-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-57-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/2128-41-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2128-55-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2128-30-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-5-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-40-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-29-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-2-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/2128-27-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-36-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-6-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-10-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-18-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-14-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2128-21-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2140-254-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2140-266-0x0000000001DE0000-0x0000000001E26000-memory.dmpFilesize
280KB
-
memory/2180-408-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2180-1905-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2192-102-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2332-631-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2332-646-0x00000000003A0000-0x00000000003E6000-memory.dmpFilesize
280KB
-
memory/2420-414-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2496-686-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2496-688-0x0000000000290000-0x00000000002D6000-memory.dmpFilesize
280KB
-
memory/2500-182-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2500-154-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2592-1853-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2592-354-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2752-153-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-60-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-76-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-68-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-64-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2752-101-0x0000000003220000-0x0000000003266000-memory.dmpFilesize
280KB
-
memory/2756-466-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2756-2053-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/2760-738-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2864-361-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2884-2345-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2884-679-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2944-575-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/3000-307-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/3024-625-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/3024-2208-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB