Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/01/2025, 21:05
Behavioral task
behavioral1
Sample
1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
Resource
win10v2004-20241007-en
General
-
Target
1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe
-
Size
2.9MB
-
MD5
b8a6ac066c127db6bdd8d30d128ce9e9
-
SHA1
b22692a1e2ace7f6c770d2d73873c6dbb0538bf9
-
SHA256
1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e
-
SHA512
bdad9f7f16baadfff81992fc274eb64c3a3ed4c0b4f5f7b753d5df8bf59a5f616d317d1a1c9694b85aa3ffabcf52a4ee15b5260eecb9341ee39d55d53e2a4295
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH0:ATU7AAmw4gxeOw46fUbNecCCFbNecd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x00080000000173a9-88.dat warzonerat behavioral1/files/0x0008000000017079-171.dat warzonerat behavioral1/files/0x0008000000017488-183.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 1700 explorer.exe 2652 explorer.exe 1716 explorer.exe 1536 spoolsv.exe 3028 spoolsv.exe 3032 spoolsv.exe 1588 spoolsv.exe 2556 spoolsv.exe 2548 spoolsv.exe 1580 spoolsv.exe 1424 spoolsv.exe 592 spoolsv.exe 2084 spoolsv.exe 852 spoolsv.exe 1120 spoolsv.exe 1516 spoolsv.exe 2452 spoolsv.exe 2680 spoolsv.exe 2676 spoolsv.exe 3024 spoolsv.exe 816 spoolsv.exe 2760 spoolsv.exe 2896 spoolsv.exe 2180 spoolsv.exe 3004 spoolsv.exe 1780 spoolsv.exe 908 spoolsv.exe 2712 spoolsv.exe 1956 spoolsv.exe 2672 spoolsv.exe 2020 spoolsv.exe 1664 spoolsv.exe 2876 spoolsv.exe 2028 spoolsv.exe 2188 spoolsv.exe 444 spoolsv.exe 2352 spoolsv.exe 852 spoolsv.exe 836 spoolsv.exe 1656 spoolsv.exe 1928 spoolsv.exe 2240 spoolsv.exe 2668 spoolsv.exe 2396 spoolsv.exe 1684 spoolsv.exe 3016 spoolsv.exe 2856 spoolsv.exe 540 spoolsv.exe 708 spoolsv.exe 2620 spoolsv.exe 2040 spoolsv.exe 2072 spoolsv.exe 1640 spoolsv.exe 2800 spoolsv.exe 576 spoolsv.exe 984 spoolsv.exe 1664 spoolsv.exe 2916 spoolsv.exe 1720 spoolsv.exe 944 explorer.exe 2028 spoolsv.exe 2224 spoolsv.exe 1944 spoolsv.exe 760 explorer.exe -
Loads dropped DLL 64 IoCs
pid Process 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 1716 explorer.exe 1716 explorer.exe 1536 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 3032 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2556 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 1580 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 592 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 852 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 1516 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2680 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 3024 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2760 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2180 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 1780 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2712 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2672 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 1664 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2028 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 444 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 852 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 1656 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 2240 spoolsv.exe 1716 explorer.exe 1716 explorer.exe -
Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2124 set thread context of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2660 set thread context of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 set thread context of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 1700 set thread context of 2652 1700 explorer.exe 38 PID 2652 set thread context of 1716 2652 explorer.exe 39 PID 2652 set thread context of 1740 2652 explorer.exe 40 PID 1536 set thread context of 3028 1536 spoolsv.exe 44 PID 3032 set thread context of 1588 3032 spoolsv.exe 47 PID 2556 set thread context of 2548 2556 spoolsv.exe 51 PID 1580 set thread context of 1424 1580 spoolsv.exe 55 PID 592 set thread context of 2084 592 spoolsv.exe 58 PID 852 set thread context of 1120 852 spoolsv.exe 63 PID 1516 set thread context of 2452 1516 spoolsv.exe 67 PID 2680 set thread context of 2676 2680 spoolsv.exe 71 PID 3024 set thread context of 816 3024 spoolsv.exe 75 PID 2760 set thread context of 2896 2760 spoolsv.exe 79 PID 2180 set thread context of 3004 2180 spoolsv.exe 83 PID 1780 set thread context of 908 1780 spoolsv.exe 87 PID 2712 set thread context of 1956 2712 spoolsv.exe 91 PID 2672 set thread context of 2020 2672 spoolsv.exe 95 PID 1664 set thread context of 2876 1664 spoolsv.exe 99 PID 2028 set thread context of 2188 2028 spoolsv.exe 103 PID 444 set thread context of 2352 444 spoolsv.exe 107 PID 852 set thread context of 836 852 spoolsv.exe 111 PID 1656 set thread context of 1928 1656 spoolsv.exe 115 PID 2240 set thread context of 2668 2240 spoolsv.exe 119 PID 2396 set thread context of 1684 2396 spoolsv.exe 123 PID 3016 set thread context of 2856 3016 spoolsv.exe 127 PID 540 set thread context of 708 540 spoolsv.exe 131 PID 2620 set thread context of 2040 2620 spoolsv.exe 135 PID 2072 set thread context of 1640 2072 spoolsv.exe 138 PID 2800 set thread context of 576 2800 spoolsv.exe 142 PID 984 set thread context of 1664 984 spoolsv.exe 146 PID 3028 set thread context of 1720 3028 spoolsv.exe 150 PID 3028 set thread context of 1936 3028 spoolsv.exe 151 PID 2916 set thread context of 2028 2916 spoolsv.exe 153 PID 1588 set thread context of 1944 1588 spoolsv.exe 159 PID 944 set thread context of 760 944 explorer.exe 156 PID 1588 set thread context of 1992 1588 spoolsv.exe 160 PID 2224 set thread context of 2832 2224 spoolsv.exe 162 PID 1856 set thread context of 3012 1856 spoolsv.exe 166 PID 2548 set thread context of 1444 2548 spoolsv.exe 169 PID 2548 set thread context of 1484 2548 spoolsv.exe 170 PID 804 set thread context of 1788 804 spoolsv.exe 173 PID 2356 set thread context of 880 2356 explorer.exe 175 PID 1424 set thread context of 2952 1424 spoolsv.exe 177 PID 1424 set thread context of 280 1424 spoolsv.exe 179 PID 2808 set thread context of 2096 2808 spoolsv.exe 181 PID 2084 set thread context of 1560 2084 spoolsv.exe 182 PID 2084 set thread context of 1796 2084 spoolsv.exe 183 PID 2240 set thread context of 2672 2240 spoolsv.exe 190 PID 1120 set thread context of 604 1120 spoolsv.exe 193 PID 1120 set thread context of 1628 1120 spoolsv.exe 194 PID 2900 set thread context of 2760 2900 explorer.exe 195 PID 2068 set thread context of 2960 2068 spoolsv.exe 196 PID 2452 set thread context of 540 2452 spoolsv.exe 199 PID 1500 set thread context of 2480 1500 spoolsv.exe 201 PID 2452 set thread context of 1036 2452 spoolsv.exe 200 PID 2676 set thread context of 2528 2676 spoolsv.exe 205 PID 2676 set thread context of 3064 2676 spoolsv.exe 207 PID 1320 set thread context of 2736 1320 spoolsv.exe 206 PID 816 set thread context of 984 816 spoolsv.exe 214 PID 816 set thread context of 496 816 spoolsv.exe 215 PID 2176 set thread context of 2268 2176 explorer.exe 216 -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2124-41-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x00080000000173a9-88.dat upx behavioral1/memory/1700-101-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0008000000017079-171.dat upx behavioral1/files/0x0008000000017488-183.dat upx behavioral1/memory/1536-195-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/3032-252-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2556-305-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1580-361-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2556-349-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/592-416-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/852-471-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1516-529-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2680-584-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1716-643-0x0000000001EB0000-0x0000000001EF6000-memory.dmp upx behavioral1/memory/3024-641-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2760-700-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2180-753-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Drops file in Windows directory 45 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 1700 explorer.exe 1536 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 3032 spoolsv.exe 1716 explorer.exe 2556 spoolsv.exe 1716 explorer.exe 1580 spoolsv.exe 1716 explorer.exe 592 spoolsv.exe 1716 explorer.exe 852 spoolsv.exe 1716 explorer.exe 1516 spoolsv.exe 1716 explorer.exe 2680 spoolsv.exe 1716 explorer.exe 3024 spoolsv.exe 1716 explorer.exe 2760 spoolsv.exe 1716 explorer.exe 2180 spoolsv.exe 1716 explorer.exe 1780 spoolsv.exe 1716 explorer.exe 2712 spoolsv.exe 1716 explorer.exe 2672 spoolsv.exe 1716 explorer.exe 1664 spoolsv.exe 1716 explorer.exe 2028 spoolsv.exe 1716 explorer.exe 444 spoolsv.exe 1716 explorer.exe 852 spoolsv.exe 1716 explorer.exe 1656 spoolsv.exe 1716 explorer.exe 2240 spoolsv.exe 1716 explorer.exe 2396 spoolsv.exe 1716 explorer.exe 3016 spoolsv.exe 1716 explorer.exe 540 spoolsv.exe 1716 explorer.exe 2620 spoolsv.exe 1716 explorer.exe 2072 spoolsv.exe 1716 explorer.exe 2800 spoolsv.exe 1716 explorer.exe 984 spoolsv.exe 1716 explorer.exe 2916 spoolsv.exe 944 explorer.exe 1716 explorer.exe 2224 spoolsv.exe 1716 explorer.exe 1856 spoolsv.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 1700 explorer.exe 1700 explorer.exe 1716 explorer.exe 1716 explorer.exe 1536 spoolsv.exe 1536 spoolsv.exe 1716 explorer.exe 1716 explorer.exe 3032 spoolsv.exe 3032 spoolsv.exe 2556 spoolsv.exe 2556 spoolsv.exe 1580 spoolsv.exe 1580 spoolsv.exe 592 spoolsv.exe 592 spoolsv.exe 852 spoolsv.exe 852 spoolsv.exe 1516 spoolsv.exe 1516 spoolsv.exe 2680 spoolsv.exe 2680 spoolsv.exe 3024 spoolsv.exe 3024 spoolsv.exe 2760 spoolsv.exe 2760 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 1780 spoolsv.exe 1780 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 2672 spoolsv.exe 2672 spoolsv.exe 1664 spoolsv.exe 1664 spoolsv.exe 2028 spoolsv.exe 2028 spoolsv.exe 444 spoolsv.exe 444 spoolsv.exe 852 spoolsv.exe 852 spoolsv.exe 1656 spoolsv.exe 1656 spoolsv.exe 2240 spoolsv.exe 2240 spoolsv.exe 2396 spoolsv.exe 2396 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 540 spoolsv.exe 540 spoolsv.exe 2620 spoolsv.exe 2620 spoolsv.exe 2072 spoolsv.exe 2072 spoolsv.exe 2800 spoolsv.exe 2800 spoolsv.exe 984 spoolsv.exe 984 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2696 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 30 PID 2124 wrote to memory of 2696 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 30 PID 2124 wrote to memory of 2696 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 30 PID 2124 wrote to memory of 2696 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 30 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2124 wrote to memory of 2660 2124 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 32 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 2088 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 33 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2660 wrote to memory of 1724 2660 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 34 PID 2088 wrote to memory of 1700 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 35 PID 2088 wrote to memory of 1700 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 35 PID 2088 wrote to memory of 1700 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 35 PID 2088 wrote to memory of 1700 2088 1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe 35 PID 1700 wrote to memory of 1484 1700 explorer.exe 36 PID 1700 wrote to memory of 1484 1700 explorer.exe 36 PID 1700 wrote to memory of 1484 1700 explorer.exe 36 PID 1700 wrote to memory of 1484 1700 explorer.exe 36 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38 PID 1700 wrote to memory of 2652 1700 explorer.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe"C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exeC:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exeC:\Users\Admin\AppData\Local\Temp\1e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:1484
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2652 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
PID:1720 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2036
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1936
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1992
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3000
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- System Location Discovery: System Language Discovery
PID:1444 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2868
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:880
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1484
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1424 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:280
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3024
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2760
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1796
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:604
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1628
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1224
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:540
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1036
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2528
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1660
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2268
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3064
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:984
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:496
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2608
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1132
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2284
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:708
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1640
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2664
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:3012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:1788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- System Location Discovery: System Language Discovery
PID:2960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2736
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:588
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:1740
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5b8a6ac066c127db6bdd8d30d128ce9e9
SHA1b22692a1e2ace7f6c770d2d73873c6dbb0538bf9
SHA2561e572ee2f0390d164e8afe0fae440b6b63794e8745d8faace5e5e080e831393e
SHA512bdad9f7f16baadfff81992fc274eb64c3a3ed4c0b4f5f7b753d5df8bf59a5f616d317d1a1c9694b85aa3ffabcf52a4ee15b5260eecb9341ee39d55d53e2a4295
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5203e7101a76f83f95da6c503e2edcbba
SHA1d6a1eb68dd8a160c3efc302745193a09ca5589f2
SHA25615f6d1ce66bdcba6def77d26cad692a2f3c923642231f3631daf650a6af193b7
SHA5126dbc5ba2ef00cafa107358ce218a9d37d4750e77c7803a5626e9de5583030ce045445d1f6567b97b0054cdea037f85fcbbefed1447aaa9c625ffd5664a4e7a59
-
Filesize
2.9MB
MD55df9c936b07b07f64668027f275133bd
SHA17ea00e106fa058212d1fa5ffe42b3c3bed8fb1d2
SHA256f88f514c1153e3a778bf091d2e2fa8b51e234f4d2d0e1560f025c199e3bd2959
SHA5120faca5a5aca955ab9811d0b297c9383fa9a2d7ed2621801b48ebc29ef9b776d15c465b4d054cdf3762bf4e6c22ef176d1619e059f4d8c949c0c1ff13432f922a