Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 15:48
Behavioral task
behavioral1
Sample
63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe
Resource
win7-20241010-en
General
-
Target
63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe
-
Size
2.2MB
-
MD5
ad40f03e91c9feae4efafd2b19d64600
-
SHA1
3d6116cb68326f5c92383673c616a5aa12fc9f1e
-
SHA256
63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700
-
SHA512
5583a149b36599dad7a75f789000193f8d3e3994f62dfd3fd26f935765257c2d037884da66e37b7ec288bf429d81e0c489871660fefb075710c61288f0cf56e8
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe -
Executes dropped EXE 64 IoCs
pid Process 4980 explorer.exe 4956 explorer.exe 2304 spoolsv.exe 3816 spoolsv.exe 4076 spoolsv.exe 3940 spoolsv.exe 1208 spoolsv.exe 1312 spoolsv.exe 1888 spoolsv.exe 2100 spoolsv.exe 5116 spoolsv.exe 2668 spoolsv.exe 4800 spoolsv.exe 3464 spoolsv.exe 1956 spoolsv.exe 4348 spoolsv.exe 4940 spoolsv.exe 3556 spoolsv.exe 3212 spoolsv.exe 4504 spoolsv.exe 3016 spoolsv.exe 1796 spoolsv.exe 2308 spoolsv.exe 3896 spoolsv.exe 3092 spoolsv.exe 4156 spoolsv.exe 4456 spoolsv.exe 244 spoolsv.exe 1436 spoolsv.exe 4916 spoolsv.exe 2924 spoolsv.exe 1784 spoolsv.exe 1712 spoolsv.exe 3132 spoolsv.exe 2472 spoolsv.exe 4652 spoolsv.exe 3864 spoolsv.exe 4828 spoolsv.exe 2256 explorer.exe 4472 spoolsv.exe 3220 spoolsv.exe 3412 spoolsv.exe 4628 spoolsv.exe 1048 spoolsv.exe 2656 spoolsv.exe 4908 spoolsv.exe 4472 spoolsv.exe 4108 explorer.exe 2060 spoolsv.exe 1456 spoolsv.exe 4308 spoolsv.exe 2980 spoolsv.exe 1568 spoolsv.exe 748 spoolsv.exe 5080 spoolsv.exe 4352 spoolsv.exe 3012 spoolsv.exe 4420 spoolsv.exe 1716 spoolsv.exe 760 spoolsv.exe 2320 spoolsv.exe 2436 spoolsv.exe 4556 spoolsv.exe 3900 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 37 IoCs
description pid Process procid_target PID 2684 set thread context of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 4980 set thread context of 4956 4980 explorer.exe 106 PID 2304 set thread context of 4828 2304 spoolsv.exe 143 PID 3816 set thread context of 4472 3816 spoolsv.exe 145 PID 3940 set thread context of 3412 3940 spoolsv.exe 147 PID 1208 set thread context of 4628 1208 spoolsv.exe 148 PID 1312 set thread context of 2656 1312 spoolsv.exe 150 PID 1888 set thread context of 4908 1888 spoolsv.exe 151 PID 2100 set thread context of 4472 2100 spoolsv.exe 152 PID 5116 set thread context of 2060 5116 spoolsv.exe 154 PID 2668 set thread context of 1456 2668 spoolsv.exe 155 PID 4800 set thread context of 4308 4800 spoolsv.exe 156 PID 3464 set thread context of 2980 3464 spoolsv.exe 157 PID 1956 set thread context of 1568 1956 spoolsv.exe 158 PID 4348 set thread context of 748 4348 spoolsv.exe 159 PID 4940 set thread context of 5080 4940 spoolsv.exe 160 PID 3556 set thread context of 3012 3556 spoolsv.exe 162 PID 3212 set thread context of 4420 3212 spoolsv.exe 163 PID 4504 set thread context of 1716 4504 spoolsv.exe 164 PID 3016 set thread context of 760 3016 spoolsv.exe 165 PID 1796 set thread context of 2320 1796 spoolsv.exe 166 PID 2308 set thread context of 2436 2308 spoolsv.exe 167 PID 3896 set thread context of 3900 3896 spoolsv.exe 169 PID 3092 set thread context of 2024 3092 spoolsv.exe 171 PID 4156 set thread context of 4476 4156 spoolsv.exe 172 PID 4456 set thread context of 2476 4456 spoolsv.exe 173 PID 244 set thread context of 5096 244 spoolsv.exe 174 PID 1436 set thread context of 4888 1436 spoolsv.exe 175 PID 4916 set thread context of 2628 4916 spoolsv.exe 177 PID 2924 set thread context of 2420 2924 spoolsv.exe 179 PID 1784 set thread context of 2684 1784 spoolsv.exe 180 PID 1712 set thread context of 1324 1712 spoolsv.exe 181 PID 3132 set thread context of 4700 3132 spoolsv.exe 182 PID 2472 set thread context of 1692 2472 spoolsv.exe 183 PID 4652 set thread context of 4016 4652 spoolsv.exe 185 PID 3864 set thread context of 2768 3864 spoolsv.exe 190 PID 2256 set thread context of 1152 2256 explorer.exe 193 -
Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4956 explorer.exe 4828 spoolsv.exe 4828 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 3412 spoolsv.exe 3412 spoolsv.exe 4628 spoolsv.exe 4628 spoolsv.exe 2656 spoolsv.exe 2656 spoolsv.exe 4908 spoolsv.exe 4908 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 2060 spoolsv.exe 2060 spoolsv.exe 1456 spoolsv.exe 1456 spoolsv.exe 4308 spoolsv.exe 4308 spoolsv.exe 2980 spoolsv.exe 2980 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 748 spoolsv.exe 748 spoolsv.exe 5080 spoolsv.exe 5080 spoolsv.exe 3012 spoolsv.exe 3012 spoolsv.exe 4420 spoolsv.exe 4420 spoolsv.exe 1716 spoolsv.exe 1716 spoolsv.exe 760 spoolsv.exe 760 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe 2436 spoolsv.exe 2436 spoolsv.exe 3900 spoolsv.exe 3900 spoolsv.exe 2024 spoolsv.exe 2024 spoolsv.exe 4476 spoolsv.exe 4476 spoolsv.exe 2476 spoolsv.exe 2476 spoolsv.exe 5096 spoolsv.exe 5096 spoolsv.exe 4888 spoolsv.exe 4888 spoolsv.exe 2628 spoolsv.exe 2628 spoolsv.exe 2420 spoolsv.exe 2420 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 1756 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 85 PID 2684 wrote to memory of 1756 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 85 PID 2684 wrote to memory of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 2684 wrote to memory of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 2684 wrote to memory of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 2684 wrote to memory of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 2684 wrote to memory of 5072 2684 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 101 PID 5072 wrote to memory of 4980 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 102 PID 5072 wrote to memory of 4980 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 102 PID 5072 wrote to memory of 4980 5072 63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe 102 PID 4980 wrote to memory of 4956 4980 explorer.exe 106 PID 4980 wrote to memory of 4956 4980 explorer.exe 106 PID 4980 wrote to memory of 4956 4980 explorer.exe 106 PID 4980 wrote to memory of 4956 4980 explorer.exe 106 PID 4980 wrote to memory of 4956 4980 explorer.exe 106 PID 4956 wrote to memory of 2304 4956 explorer.exe 107 PID 4956 wrote to memory of 2304 4956 explorer.exe 107 PID 4956 wrote to memory of 2304 4956 explorer.exe 107 PID 4956 wrote to memory of 3816 4956 explorer.exe 108 PID 4956 wrote to memory of 3816 4956 explorer.exe 108 PID 4956 wrote to memory of 3816 4956 explorer.exe 108 PID 4956 wrote to memory of 4076 4956 explorer.exe 109 PID 4956 wrote to memory of 4076 4956 explorer.exe 109 PID 4956 wrote to memory of 4076 4956 explorer.exe 109 PID 4956 wrote to memory of 3940 4956 explorer.exe 110 PID 4956 wrote to memory of 3940 4956 explorer.exe 110 PID 4956 wrote to memory of 3940 4956 explorer.exe 110 PID 4956 wrote to memory of 1208 4956 explorer.exe 111 PID 4956 wrote to memory of 1208 4956 explorer.exe 111 PID 4956 wrote to memory of 1208 4956 explorer.exe 111 PID 4956 wrote to memory of 1312 4956 explorer.exe 112 PID 4956 wrote to memory of 1312 4956 explorer.exe 112 PID 4956 wrote to memory of 1312 4956 explorer.exe 112 PID 4956 wrote to memory of 1888 4956 explorer.exe 114 PID 4956 wrote to memory of 1888 4956 explorer.exe 114 PID 4956 wrote to memory of 1888 4956 explorer.exe 114 PID 4956 wrote to memory of 2100 4956 explorer.exe 115 PID 4956 wrote to memory of 2100 4956 explorer.exe 115 PID 4956 wrote to memory of 2100 4956 explorer.exe 115 PID 4956 wrote to memory of 5116 4956 explorer.exe 116 PID 4956 wrote to memory of 5116 4956 explorer.exe 116 PID 4956 wrote to memory of 5116 4956 explorer.exe 116 PID 4956 wrote to memory of 2668 4956 explorer.exe 117 PID 4956 wrote to memory of 2668 4956 explorer.exe 117 PID 4956 wrote to memory of 2668 4956 explorer.exe 117 PID 4956 wrote to memory of 4800 4956 explorer.exe 118 PID 4956 wrote to memory of 4800 4956 explorer.exe 118 PID 4956 wrote to memory of 4800 4956 explorer.exe 118 PID 4956 wrote to memory of 3464 4956 explorer.exe 119 PID 4956 wrote to memory of 3464 4956 explorer.exe 119 PID 4956 wrote to memory of 3464 4956 explorer.exe 119 PID 4956 wrote to memory of 1956 4956 explorer.exe 120 PID 4956 wrote to memory of 1956 4956 explorer.exe 120 PID 4956 wrote to memory of 1956 4956 explorer.exe 120 PID 4956 wrote to memory of 4348 4956 explorer.exe 121 PID 4956 wrote to memory of 4348 4956 explorer.exe 121 PID 4956 wrote to memory of 4348 4956 explorer.exe 121 PID 4956 wrote to memory of 4940 4956 explorer.exe 122 PID 4956 wrote to memory of 4940 4956 explorer.exe 122 PID 4956 wrote to memory of 4940 4956 explorer.exe 122 PID 4956 wrote to memory of 3556 4956 explorer.exe 123 PID 4956 wrote to memory of 3556 4956 explorer.exe 123 PID 4956 wrote to memory of 3556 4956 explorer.exe 123 PID 4956 wrote to memory of 3212 4956 explorer.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4108
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4308
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:748
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3900 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4156 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2020
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4700
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1692
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4016 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3840
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4160
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4352
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4556
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4416
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4452
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:428
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4816
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2900
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5c7bc68791b5fe028bf9fcb6fe51bdd6a
SHA1bccdab5936cffe63406579b9f3f4ad47e977d75b
SHA2560d87f23b37b45a142b5c93d17ffa7534ed4e8c3d8d97c5968f559d0ceacb52a9
SHA5120e07a2356ab1698fda5b427505e7605f67f4d70d15e1ba5ccb87afb55bce17937e7dc9324ae4a51fb7ade861f2c983697a175a9a4918b4d11687429f2784a378
-
Filesize
2.2MB
MD5b93c6535b48ef2a520d150d1f45aa744
SHA1d9d9ffea726d13691c91ac82a69d576a15aa8096
SHA2563440d025bdfa5a864042e6b2d9cd41cc9443a99f362a7bf1e6b1d61800ef2678
SHA5126e2c2843788430a3def717664a05d8c203c5cb62c7897d42954255adf5c5d667804289b5307a259bc23153b9f0e0858307758190e8bca4447d6561f5e49f9efc