Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 11:11
Behavioral task
behavioral1
Sample
abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe
Resource
win10v2004-20241007-en
General
-
Target
abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe
-
Size
1.8MB
-
MD5
75ba1a7c4abff1d0e9175744abeac050
-
SHA1
4aa33c759c6322a6cf46e5c423e681de2671cf48
-
SHA256
abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578d
-
SHA512
209464d6fadc6845288b1a5e39acdd3cf6eb0bb47b77755ac6b22bf1d99836107c663e2cb82e57e6b77cfcf5be6d4069d62f47b0e2b40809967609936a634bf1
-
SSDEEP
12288:BUrjP8Xuc2UY0B8TIwDDMistJ6gicRzubSFJeOgTpBA7W2FeDSIGVH/KIDgDgUe6:ujjSYIUDJ86giGTPQDbGV6eH81ku
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0003000000018334-36.dat warzonerat behavioral1/files/0x000700000001756b-64.dat warzonerat behavioral1/files/0x00090000000186b7-78.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Executes dropped EXE 64 IoCs
pid Process 2544 explorer.exe 3068 explorer.exe 2416 spoolsv.exe 3028 spoolsv.exe 1824 spoolsv.exe 2184 spoolsv.exe 2644 spoolsv.exe 2200 spoolsv.exe 2480 spoolsv.exe 1796 spoolsv.exe 1792 spoolsv.exe 2252 spoolsv.exe 1676 spoolsv.exe 2008 spoolsv.exe 1248 spoolsv.exe 928 spoolsv.exe 2564 spoolsv.exe 1628 spoolsv.exe 2288 spoolsv.exe 3008 spoolsv.exe 792 spoolsv.exe 2948 spoolsv.exe 2996 spoolsv.exe 2904 spoolsv.exe 2912 spoolsv.exe 3024 spoolsv.exe 2592 spoolsv.exe 2708 spoolsv.exe 2396 spoolsv.exe 2020 spoolsv.exe 2632 spoolsv.exe 2764 spoolsv.exe 3060 spoolsv.exe 2544 spoolsv.exe 2360 spoolsv.exe 2336 spoolsv.exe 3040 spoolsv.exe 2068 spoolsv.exe 1140 spoolsv.exe 2044 spoolsv.exe 1588 spoolsv.exe 2280 spoolsv.exe 2180 spoolsv.exe 316 spoolsv.exe 2156 spoolsv.exe 2640 spoolsv.exe 2176 spoolsv.exe 2324 spoolsv.exe 112 spoolsv.exe 932 spoolsv.exe 1304 spoolsv.exe 956 spoolsv.exe 740 spoolsv.exe 1688 spoolsv.exe 2628 spoolsv.exe 332 spoolsv.exe 1600 spoolsv.exe 1984 spoolsv.exe 1132 spoolsv.exe 1968 spoolsv.exe 2652 spoolsv.exe 1532 spoolsv.exe 2732 spoolsv.exe 1708 spoolsv.exe -
Loads dropped DLL 64 IoCs
pid Process 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2328 set thread context of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 set thread context of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2544 set thread context of 3068 2544 explorer.exe 32 PID 2544 set thread context of 2668 2544 explorer.exe 33 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2888 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 29 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2328 wrote to memory of 2892 2328 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 30 PID 2888 wrote to memory of 2544 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 31 PID 2888 wrote to memory of 2544 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 31 PID 2888 wrote to memory of 2544 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 31 PID 2888 wrote to memory of 2544 2888 abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe 31 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 3068 2544 explorer.exe 32 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 2544 wrote to memory of 2668 2544 explorer.exe 33 PID 3068 wrote to memory of 2416 3068 explorer.exe 34 PID 3068 wrote to memory of 2416 3068 explorer.exe 34 PID 3068 wrote to memory of 2416 3068 explorer.exe 34 PID 3068 wrote to memory of 2416 3068 explorer.exe 34 PID 3068 wrote to memory of 3028 3068 explorer.exe 35 PID 3068 wrote to memory of 3028 3068 explorer.exe 35 PID 3068 wrote to memory of 3028 3068 explorer.exe 35 PID 3068 wrote to memory of 3028 3068 explorer.exe 35 PID 3068 wrote to memory of 1824 3068 explorer.exe 36 PID 3068 wrote to memory of 1824 3068 explorer.exe 36 PID 3068 wrote to memory of 1824 3068 explorer.exe 36 PID 3068 wrote to memory of 1824 3068 explorer.exe 36 PID 3068 wrote to memory of 2184 3068 explorer.exe 37 PID 3068 wrote to memory of 2184 3068 explorer.exe 37 PID 3068 wrote to memory of 2184 3068 explorer.exe 37 PID 3068 wrote to memory of 2184 3068 explorer.exe 37 PID 3068 wrote to memory of 2644 3068 explorer.exe 38 PID 3068 wrote to memory of 2644 3068 explorer.exe 38 PID 3068 wrote to memory of 2644 3068 explorer.exe 38 PID 3068 wrote to memory of 2644 3068 explorer.exe 38 PID 3068 wrote to memory of 2200 3068 explorer.exe 39 PID 3068 wrote to memory of 2200 3068 explorer.exe 39 PID 3068 wrote to memory of 2200 3068 explorer.exe 39 PID 3068 wrote to memory of 2200 3068 explorer.exe 39 PID 3068 wrote to memory of 2480 3068 explorer.exe 40 PID 3068 wrote to memory of 2480 3068 explorer.exe 40 PID 3068 wrote to memory of 2480 3068 explorer.exe 40 PID 3068 wrote to memory of 2480 3068 explorer.exe 40 PID 3068 wrote to memory of 1796 3068 explorer.exe 41 PID 3068 wrote to memory of 1796 3068 explorer.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe"C:\Users\Admin\AppData\Local\Temp\abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe"C:\Users\Admin\AppData\Local\Temp\abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578dN.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2416
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2184
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2644
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2200
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3060
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2156
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2176
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1600
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1132
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1088
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:760
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2136
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1340
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2612
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2600
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2144
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2368
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:916
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2096
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2712
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2348
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2284
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:756
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2736
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2908
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:2668
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD575ba1a7c4abff1d0e9175744abeac050
SHA14aa33c759c6322a6cf46e5c423e681de2671cf48
SHA256abe385f88e54ae99d85ee2e832f85852e9e39212013e9cae7e126d29ce88578d
SHA512209464d6fadc6845288b1a5e39acdd3cf6eb0bb47b77755ac6b22bf1d99836107c663e2cb82e57e6b77cfcf5be6d4069d62f47b0e2b40809967609936a634bf1
-
Filesize
1.8MB
MD5ce84ea546559f49078f121d8b8d9ff64
SHA18e75101872271bb6dff78bcf594ee69041e0305c
SHA2563215a24d4fa778b3284a2e7922c671a52184881b97a64fc9ec8e3d97de249f20
SHA5129123aa6240531fc2ab0a0ca933c874adae7337229018dee447b920cbc90933f878833cf23bb27c6b43d552c1b573bb87a3c3fb59ced255bae4bd022441b438aa
-
Filesize
1.8MB
MD5083bcf0e90d36a884469f5ab6d6f6718
SHA10e97e41bc0afefe1548759d4dddf406a4f8c2fc9
SHA2566f4565153a1e0390fffd9f266c61f030e743e723c6807c986dc52db94660e71d
SHA512a5a746a8dd37607612c4aa4346c21043a237cbb55d4026b8b92deec1e3701da7de50a82e6d3992845d403534fbbdd43affe1ad4a1e6697047bfafc994716c609