Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 14:42
Behavioral task
behavioral1
Sample
f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe
Resource
win7-20241010-en
General
-
Target
f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe
-
Size
2.2MB
-
MD5
a6dd568e86cc6e961ec108af1995e1f0
-
SHA1
298545a3cfd4c1916cd67ed43dc42546d5d6d730
-
SHA256
f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3
-
SHA512
316388b6b44921d9e6ce0ea45420e3160a99b050572c7dcd666719c6eb5a8cbe176753bf6b243a0242fe39b1d878cf127ceddc3a4dedf8d52b6688cb4c8182ec
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWww8
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe -
Executes dropped EXE 64 IoCs
pid Process 2932 explorer.exe 2524 explorer.exe 4780 spoolsv.exe 4140 spoolsv.exe 2536 spoolsv.exe 3980 spoolsv.exe 1976 spoolsv.exe 3788 spoolsv.exe 1996 spoolsv.exe 1424 spoolsv.exe 2356 spoolsv.exe 3764 spoolsv.exe 3460 spoolsv.exe 2968 spoolsv.exe 4384 spoolsv.exe 432 spoolsv.exe 2828 spoolsv.exe 4580 spoolsv.exe 2940 spoolsv.exe 1008 spoolsv.exe 3560 spoolsv.exe 1540 spoolsv.exe 4556 spoolsv.exe 60 spoolsv.exe 1812 spoolsv.exe 4804 spoolsv.exe 4524 spoolsv.exe 3564 spoolsv.exe 4032 spoolsv.exe 1056 spoolsv.exe 4316 spoolsv.exe 4592 spoolsv.exe 4956 spoolsv.exe 636 spoolsv.exe 5024 spoolsv.exe 2372 spoolsv.exe 4492 spoolsv.exe 1856 spoolsv.exe 3144 spoolsv.exe 388 explorer.exe 3628 spoolsv.exe 2848 spoolsv.exe 4256 spoolsv.exe 992 spoolsv.exe 5000 spoolsv.exe 2196 spoolsv.exe 4388 spoolsv.exe 1156 spoolsv.exe 4424 spoolsv.exe 3064 explorer.exe 936 spoolsv.exe 2416 spoolsv.exe 3444 spoolsv.exe 2796 spoolsv.exe 1308 spoolsv.exe 4984 spoolsv.exe 1548 spoolsv.exe 2020 spoolsv.exe 3124 spoolsv.exe 748 spoolsv.exe 2152 explorer.exe 3112 spoolsv.exe 1312 spoolsv.exe 3116 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 40 IoCs
description pid Process procid_target PID 4184 set thread context of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 2932 set thread context of 2524 2932 explorer.exe 103 PID 4780 set thread context of 3144 4780 spoolsv.exe 140 PID 4140 set thread context of 3628 4140 spoolsv.exe 142 PID 2536 set thread context of 2848 2536 spoolsv.exe 143 PID 3980 set thread context of 4256 3980 spoolsv.exe 144 PID 1976 set thread context of 5000 1976 spoolsv.exe 146 PID 3788 set thread context of 2196 3788 spoolsv.exe 147 PID 1996 set thread context of 4388 1996 spoolsv.exe 148 PID 1424 set thread context of 1156 1424 spoolsv.exe 149 PID 2356 set thread context of 4424 2356 spoolsv.exe 150 PID 3764 set thread context of 936 3764 spoolsv.exe 152 PID 3460 set thread context of 2416 3460 spoolsv.exe 153 PID 2968 set thread context of 3444 2968 spoolsv.exe 154 PID 4384 set thread context of 2796 4384 spoolsv.exe 155 PID 432 set thread context of 4984 432 spoolsv.exe 157 PID 2828 set thread context of 1548 2828 spoolsv.exe 158 PID 4580 set thread context of 2020 4580 spoolsv.exe 159 PID 2940 set thread context of 3124 2940 spoolsv.exe 160 PID 1008 set thread context of 748 1008 spoolsv.exe 161 PID 3560 set thread context of 3112 3560 spoolsv.exe 163 PID 1540 set thread context of 1312 1540 spoolsv.exe 164 PID 4556 set thread context of 1260 4556 spoolsv.exe 166 PID 60 set thread context of 3036 60 spoolsv.exe 167 PID 1812 set thread context of 1732 1812 spoolsv.exe 168 PID 4804 set thread context of 3332 4804 spoolsv.exe 169 PID 4524 set thread context of 1392 4524 spoolsv.exe 171 PID 3564 set thread context of 1988 3564 spoolsv.exe 173 PID 4032 set thread context of 4788 4032 spoolsv.exe 174 PID 1056 set thread context of 1804 1056 spoolsv.exe 175 PID 4316 set thread context of 1628 4316 spoolsv.exe 176 PID 4592 set thread context of 2364 4592 spoolsv.exe 178 PID 4956 set thread context of 4512 4956 spoolsv.exe 180 PID 636 set thread context of 1832 636 spoolsv.exe 181 PID 5024 set thread context of 1696 5024 spoolsv.exe 182 PID 2372 set thread context of 2388 2372 spoolsv.exe 183 PID 4492 set thread context of 4816 4492 spoolsv.exe 185 PID 1856 set thread context of 3528 1856 spoolsv.exe 191 PID 388 set thread context of 1420 388 explorer.exe 195 PID 992 set thread context of 1808 992 spoolsv.exe 200 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 2524 explorer.exe 3144 spoolsv.exe 3144 spoolsv.exe 3628 spoolsv.exe 3628 spoolsv.exe 2848 spoolsv.exe 2848 spoolsv.exe 4256 spoolsv.exe 4256 spoolsv.exe 5000 spoolsv.exe 5000 spoolsv.exe 2196 spoolsv.exe 2196 spoolsv.exe 4388 spoolsv.exe 4388 spoolsv.exe 1156 spoolsv.exe 1156 spoolsv.exe 4424 spoolsv.exe 4424 spoolsv.exe 936 spoolsv.exe 936 spoolsv.exe 2416 spoolsv.exe 2416 spoolsv.exe 3444 spoolsv.exe 3444 spoolsv.exe 2796 spoolsv.exe 2796 spoolsv.exe 4984 spoolsv.exe 4984 spoolsv.exe 1548 spoolsv.exe 1548 spoolsv.exe 2020 spoolsv.exe 2020 spoolsv.exe 3124 spoolsv.exe 3124 spoolsv.exe 748 spoolsv.exe 748 spoolsv.exe 3112 spoolsv.exe 3112 spoolsv.exe 1312 spoolsv.exe 1312 spoolsv.exe 1260 spoolsv.exe 1260 spoolsv.exe 3036 spoolsv.exe 3036 spoolsv.exe 1732 spoolsv.exe 1732 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 1392 spoolsv.exe 1392 spoolsv.exe 1988 spoolsv.exe 1988 spoolsv.exe 4788 spoolsv.exe 4788 spoolsv.exe 1804 spoolsv.exe 1804 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4184 wrote to memory of 2064 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 83 PID 4184 wrote to memory of 2064 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 83 PID 4184 wrote to memory of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 4184 wrote to memory of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 4184 wrote to memory of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 4184 wrote to memory of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 4184 wrote to memory of 1780 4184 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 98 PID 1780 wrote to memory of 2932 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 99 PID 1780 wrote to memory of 2932 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 99 PID 1780 wrote to memory of 2932 1780 f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe 99 PID 2932 wrote to memory of 2524 2932 explorer.exe 103 PID 2932 wrote to memory of 2524 2932 explorer.exe 103 PID 2932 wrote to memory of 2524 2932 explorer.exe 103 PID 2932 wrote to memory of 2524 2932 explorer.exe 103 PID 2932 wrote to memory of 2524 2932 explorer.exe 103 PID 2524 wrote to memory of 4780 2524 explorer.exe 104 PID 2524 wrote to memory of 4780 2524 explorer.exe 104 PID 2524 wrote to memory of 4780 2524 explorer.exe 104 PID 2524 wrote to memory of 4140 2524 explorer.exe 105 PID 2524 wrote to memory of 4140 2524 explorer.exe 105 PID 2524 wrote to memory of 4140 2524 explorer.exe 105 PID 2524 wrote to memory of 2536 2524 explorer.exe 106 PID 2524 wrote to memory of 2536 2524 explorer.exe 106 PID 2524 wrote to memory of 2536 2524 explorer.exe 106 PID 2524 wrote to memory of 3980 2524 explorer.exe 107 PID 2524 wrote to memory of 3980 2524 explorer.exe 107 PID 2524 wrote to memory of 3980 2524 explorer.exe 107 PID 2524 wrote to memory of 1976 2524 explorer.exe 108 PID 2524 wrote to memory of 1976 2524 explorer.exe 108 PID 2524 wrote to memory of 1976 2524 explorer.exe 108 PID 2524 wrote to memory of 3788 2524 explorer.exe 109 PID 2524 wrote to memory of 3788 2524 explorer.exe 109 PID 2524 wrote to memory of 3788 2524 explorer.exe 109 PID 2524 wrote to memory of 1996 2524 explorer.exe 110 PID 2524 wrote to memory of 1996 2524 explorer.exe 110 PID 2524 wrote to memory of 1996 2524 explorer.exe 110 PID 2524 wrote to memory of 1424 2524 explorer.exe 111 PID 2524 wrote to memory of 1424 2524 explorer.exe 111 PID 2524 wrote to memory of 1424 2524 explorer.exe 111 PID 2524 wrote to memory of 2356 2524 explorer.exe 112 PID 2524 wrote to memory of 2356 2524 explorer.exe 112 PID 2524 wrote to memory of 2356 2524 explorer.exe 112 PID 2524 wrote to memory of 3764 2524 explorer.exe 113 PID 2524 wrote to memory of 3764 2524 explorer.exe 113 PID 2524 wrote to memory of 3764 2524 explorer.exe 113 PID 2524 wrote to memory of 3460 2524 explorer.exe 114 PID 2524 wrote to memory of 3460 2524 explorer.exe 114 PID 2524 wrote to memory of 3460 2524 explorer.exe 114 PID 2524 wrote to memory of 2968 2524 explorer.exe 115 PID 2524 wrote to memory of 2968 2524 explorer.exe 115 PID 2524 wrote to memory of 2968 2524 explorer.exe 115 PID 2524 wrote to memory of 4384 2524 explorer.exe 116 PID 2524 wrote to memory of 4384 2524 explorer.exe 116 PID 2524 wrote to memory of 4384 2524 explorer.exe 116 PID 2524 wrote to memory of 432 2524 explorer.exe 117 PID 2524 wrote to memory of 432 2524 explorer.exe 117 PID 2524 wrote to memory of 432 2524 explorer.exe 117 PID 2524 wrote to memory of 2828 2524 explorer.exe 118 PID 2524 wrote to memory of 2828 2524 explorer.exe 118 PID 2524 wrote to memory of 2828 2524 explorer.exe 118 PID 2524 wrote to memory of 4580 2524 explorer.exe 119 PID 2524 wrote to memory of 4580 2524 explorer.exe 119 PID 2524 wrote to memory of 4580 2524 explorer.exe 119 PID 2524 wrote to memory of 2940 2524 explorer.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe"C:\Users\Admin\AppData\Local\Temp\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe"C:\Users\Admin\AppData\Local\Temp\f619805c1788fade732c6a375587eb96d0b50048edb2dc4f25095df1d4bf2ca3N.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3144 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1420
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4424 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3064
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:936
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2152
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1732
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1392 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1920
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4512
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2388
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2340
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3528
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2352
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1808
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:2800
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1308
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1196
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3556
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5160969f68da567a4b8923f37cfe7dc7d
SHA1dd939d5366b39c0c602bc8abd49d7c74b5c0328c
SHA2563ba3998b29331d3ba36403479e8823b42775c63537b537a1c7b99ed35b3fe3d9
SHA51253cfe39fe2138e219d7db9fd3c86eec525c9c834272ffac871e5cebb92840c90ce40647d1af51833822f4d8a6ebb520dd6fa79d9f84430e0876b4e66c8d4f877
-
Filesize
2.2MB
MD5337fd9aaccc7a9746fa32835dcc53a86
SHA189cf904f7f797b470ff51988e8e2db5b4c764b16
SHA256c75e27582f650bbddea884aac37a275abcd16ce6cd0bb92610a77a56ae956258
SHA512c64c85bebcebbb787f634a6f2649d894c80393f5290eb109dc830fdbd15622b51c765f1e403ff67770b3082548765e3b0b5c385211e4473e27cb4b0d0b286f0f