Analysis
-
max time kernel
119s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2024 12:42
Behavioral task
behavioral1
Sample
830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
Resource
win10v2004-20241007-en
General
-
Target
830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe
-
Size
2.9MB
-
MD5
114a26070e503bb2959c8cf89beccd10
-
SHA1
8b6c92b087d0e365db42f0b3db92b61f86e5b139
-
SHA256
830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7
-
SHA512
8d6bc52a2d0925fe2abb4f35f1602c01cd3782d8cdbdfada66164e5abb030ed6347fe0c222f2e3a07afb9510e1a61e76c72895e72aa766939a95e4d7283731d6
-
SSDEEP
24576:bTO7AsmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHb:bTO7Asmw4gxeOw46fUbNecCCFbNec+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x0008000000023cce-33.dat warzonerat behavioral2/files/0x0008000000023ccb-59.dat warzonerat behavioral2/files/0x0008000000023cd1-73.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 27 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 52 IoCs
pid Process 4936 explorer.exe 4300 explorer.exe 4500 explorer.exe 4768 spoolsv.exe 5116 spoolsv.exe 2068 spoolsv.exe 1232 spoolsv.exe 4336 spoolsv.exe 996 spoolsv.exe 2736 spoolsv.exe 4696 spoolsv.exe 3464 spoolsv.exe 3672 spoolsv.exe 2468 spoolsv.exe 4436 spoolsv.exe 4348 spoolsv.exe 4608 spoolsv.exe 4808 spoolsv.exe 2624 spoolsv.exe 3136 spoolsv.exe 4836 spoolsv.exe 3952 spoolsv.exe 4908 spoolsv.exe 1684 spoolsv.exe 4976 spoolsv.exe 4448 spoolsv.exe 3360 spoolsv.exe 1724 spoolsv.exe 3524 spoolsv.exe 396 spoolsv.exe 1020 spoolsv.exe 3188 spoolsv.exe 4468 spoolsv.exe 2940 spoolsv.exe 2904 spoolsv.exe 4316 spoolsv.exe 2068 spoolsv.exe 2284 spoolsv.exe 4676 spoolsv.exe 4972 spoolsv.exe 4288 spoolsv.exe 1700 spoolsv.exe 4580 spoolsv.exe 3464 spoolsv.exe 2804 spoolsv.exe 1444 spoolsv.exe 1612 spoolsv.exe 4876 spoolsv.exe 4828 spoolsv.exe 1068 spoolsv.exe 4276 spoolsv.exe 4772 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 29 IoCs
description pid Process procid_target PID 2208 set thread context of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 3068 set thread context of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 set thread context of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 4936 set thread context of 4300 4936 explorer.exe 106 PID 4300 set thread context of 4500 4300 explorer.exe 108 PID 4768 set thread context of 5116 4768 spoolsv.exe 113 PID 2068 set thread context of 1232 2068 spoolsv.exe 117 PID 4336 set thread context of 996 4336 spoolsv.exe 121 PID 2736 set thread context of 4696 2736 spoolsv.exe 125 PID 3464 set thread context of 3672 3464 spoolsv.exe 129 PID 2468 set thread context of 4436 2468 spoolsv.exe 133 PID 4348 set thread context of 4608 4348 spoolsv.exe 137 PID 4808 set thread context of 2624 4808 spoolsv.exe 141 PID 3136 set thread context of 4836 3136 spoolsv.exe 147 PID 3952 set thread context of 4908 3952 spoolsv.exe 153 PID 1684 set thread context of 4976 1684 spoolsv.exe 157 PID 4448 set thread context of 3360 4448 spoolsv.exe 164 PID 1724 set thread context of 3524 1724 spoolsv.exe 169 PID 396 set thread context of 1020 396 spoolsv.exe 173 PID 3188 set thread context of 4468 3188 spoolsv.exe 177 PID 2940 set thread context of 2904 2940 spoolsv.exe 181 PID 4316 set thread context of 2068 4316 spoolsv.exe 185 PID 2284 set thread context of 4676 2284 spoolsv.exe 189 PID 4972 set thread context of 4288 4972 spoolsv.exe 193 PID 1700 set thread context of 4580 1700 spoolsv.exe 197 PID 3464 set thread context of 2804 3464 spoolsv.exe 201 PID 1444 set thread context of 1612 1444 spoolsv.exe 205 PID 4876 set thread context of 4828 4876 spoolsv.exe 209 PID 1068 set thread context of 4276 1068 spoolsv.exe 213 -
Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 4936 explorer.exe 4936 explorer.exe 4768 spoolsv.exe 4768 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 4500 explorer.exe 2068 spoolsv.exe 2068 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 4336 spoolsv.exe 4336 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 2736 spoolsv.exe 2736 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 3464 spoolsv.exe 3464 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 2468 spoolsv.exe 2468 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 4348 spoolsv.exe 4348 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 4808 spoolsv.exe 4808 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 3136 spoolsv.exe 3136 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 3952 spoolsv.exe 3952 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 1684 spoolsv.exe 1684 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 4448 spoolsv.exe 4448 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 1724 spoolsv.exe 1724 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 396 spoolsv.exe 396 spoolsv.exe 4500 explorer.exe 4500 explorer.exe -
Suspicious use of SetWindowsHookEx 60 IoCs
pid Process 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 4936 explorer.exe 4936 explorer.exe 4500 explorer.exe 4500 explorer.exe 4768 spoolsv.exe 4768 spoolsv.exe 4500 explorer.exe 4500 explorer.exe 2068 spoolsv.exe 2068 spoolsv.exe 4336 spoolsv.exe 4336 spoolsv.exe 2736 spoolsv.exe 2736 spoolsv.exe 3464 spoolsv.exe 3464 spoolsv.exe 2468 spoolsv.exe 2468 spoolsv.exe 4348 spoolsv.exe 4348 spoolsv.exe 4808 spoolsv.exe 4808 spoolsv.exe 3136 spoolsv.exe 3136 spoolsv.exe 3952 spoolsv.exe 3952 spoolsv.exe 1684 spoolsv.exe 1684 spoolsv.exe 4448 spoolsv.exe 4448 spoolsv.exe 1724 spoolsv.exe 1724 spoolsv.exe 396 spoolsv.exe 396 spoolsv.exe 3188 spoolsv.exe 3188 spoolsv.exe 2940 spoolsv.exe 2940 spoolsv.exe 4316 spoolsv.exe 4316 spoolsv.exe 2284 spoolsv.exe 2284 spoolsv.exe 4972 spoolsv.exe 4972 spoolsv.exe 1700 spoolsv.exe 1700 spoolsv.exe 3464 spoolsv.exe 3464 spoolsv.exe 1444 spoolsv.exe 1444 spoolsv.exe 4876 spoolsv.exe 4876 spoolsv.exe 1068 spoolsv.exe 1068 spoolsv.exe 4772 spoolsv.exe 4772 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1876 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 84 PID 2208 wrote to memory of 1876 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 84 PID 2208 wrote to memory of 1876 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 84 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 2208 wrote to memory of 3068 2208 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 89 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 3128 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 101 PID 3068 wrote to memory of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 3068 wrote to memory of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 3068 wrote to memory of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 3068 wrote to memory of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 3068 wrote to memory of 432 3068 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 102 PID 3128 wrote to memory of 4936 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 103 PID 3128 wrote to memory of 4936 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 103 PID 3128 wrote to memory of 4936 3128 830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe 103 PID 4936 wrote to memory of 372 4936 explorer.exe 104 PID 4936 wrote to memory of 372 4936 explorer.exe 104 PID 4936 wrote to memory of 372 4936 explorer.exe 104 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106 PID 4936 wrote to memory of 4300 4936 explorer.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe"C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exeC:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exeC:\Users\Admin\AppData\Local\Temp\830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7N.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:372
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4300 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1500
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1232
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3424
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2284
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3360
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3524
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4288
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:664
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1416
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4076
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:432
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5114a26070e503bb2959c8cf89beccd10
SHA18b6c92b087d0e365db42f0b3db92b61f86e5b139
SHA256830994c6882c24b5e15d5d17451c91a6668a61a29401cfb13cfb2b0923fd71e7
SHA5128d6bc52a2d0925fe2abb4f35f1602c01cd3782d8cdbdfada66164e5abb030ed6347fe0c222f2e3a07afb9510e1a61e76c72895e72aa766939a95e4d7283731d6
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5e347d2d32474641eb504d970709eb21a
SHA17c7979e70bd319cdc2d296452dbbb4fbc899b9e6
SHA256e3cb899ce317406d4e1098098b2110a78f20e440366bf99c5ec86426532c29b1
SHA512b0c908fe5d6cb30741d507baac3d23a8a424468a15c3d21a63e9a3946f57fd4167aa6006eb0880950eeaa2e2d8ce7cdabbc984a0dca6121ca0b0dc03b84b4857
-
Filesize
2.9MB
MD500f286c469dd7f87a5d43064d833a044
SHA1deaab5205e2028fcf5c0b906977c02ba78c37505
SHA256c42a309836b620689f2c1e59e8ee9d9d5ad0526301df10aff81b594cb053d2e0
SHA5129b6b602c441746a79d9cb194a9bfc41b2307724cba9e4fdbd412fe58485e18b2df08e5d9c6a6464ec7129840fc8e92a8fe3ad06a24fd344f6cfa6a5b7fc37a13