warzonerat | 842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
Size

2.9MB
MD5

80a5d11403897e71333963a7055d233b
SHA1

4e5a243787b0e1f806457ab39a2a8df78f576f67
SHA256

842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee
SHA512

32c0e43e3962dd7762e83ad590e678a4ef93969bc36b5d53f5237ce069290ad896d3475fab12abed3b0726d14f29397ba93065a9f50d465e55bf8ca0017bc0b6
SSDEEP

24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH2:ATU7AAmw4gxeOw46fUbNecCCFbNecn

Score

10^/10

warzonerat discovery evasion infostealer persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x00080000000174b4-87.dat	warzonerat
behavioral1/files/0x0008000000016f02-166.dat	warzonerat
behavioral1/files/0x000a000000016f02-182.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 33 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
1948	explorer.exe
1932	explorer.exe
1484	explorer.exe
1856	spoolsv.exe
2508	spoolsv.exe
2680	spoolsv.exe
2816	spoolsv.exe
3056	spoolsv.exe
1228	spoolsv.exe
2312	spoolsv.exe
1192	spoolsv.exe
824	spoolsv.exe
2988	spoolsv.exe
1984	spoolsv.exe
1804	spoolsv.exe
1548	spoolsv.exe
2520	spoolsv.exe
2656	spoolsv.exe
2596	spoolsv.exe
1424	spoolsv.exe
2664	spoolsv.exe
2124	spoolsv.exe
1760	spoolsv.exe
320	spoolsv.exe
356	spoolsv.exe
1260	spoolsv.exe
588	spoolsv.exe
2100	spoolsv.exe
1008	spoolsv.exe
2736	spoolsv.exe
2584	spoolsv.exe
1684	spoolsv.exe
1000	spoolsv.exe
2600	spoolsv.exe
3044	spoolsv.exe
2840	spoolsv.exe
2544	spoolsv.exe
2348	spoolsv.exe
1716	spoolsv.exe
2064	spoolsv.exe
1340	spoolsv.exe
2732	spoolsv.exe
2196	spoolsv.exe
2740	spoolsv.exe
2940	spoolsv.exe
696	spoolsv.exe
2060	spoolsv.exe
2260	spoolsv.exe
2956	spoolsv.exe
2428	spoolsv.exe
1648	spoolsv.exe
2164	spoolsv.exe
2032	spoolsv.exe
2696	spoolsv.exe
2792	spoolsv.exe
2872	spoolsv.exe
1424	spoolsv.exe
3068	spoolsv.exe
2432	spoolsv.exe
1672	spoolsv.exe
856	spoolsv.exe
2468	spoolsv.exe
1448	spoolsv.exe
2912	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
1484	explorer.exe
1484	explorer.exe
1856	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2680	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
3056	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2312	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
824	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
1984	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
1548	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2656	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
1424	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2124	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
320	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
1260	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2100	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2736	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
1684	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2600	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2840	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2348	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2064	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2732	spoolsv.exe
1484	explorer.exe
1484	explorer.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2764 set thread context of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 set thread context of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 1948 set thread context of 1932	1948	explorer.exe	39
PID 1932 set thread context of 1484	1932	explorer.exe	41
PID 1932 set thread context of 2416	1932	explorer.exe	42
PID 1856 set thread context of 2508	1856	spoolsv.exe	46
PID 2680 set thread context of 2816	2680	spoolsv.exe	50
PID 3056 set thread context of 1228	3056	spoolsv.exe	54
PID 2312 set thread context of 1192	2312	spoolsv.exe	58
PID 824 set thread context of 2988	824	spoolsv.exe	62
PID 1984 set thread context of 1804	1984	spoolsv.exe	65
PID 1548 set thread context of 2520	1548	spoolsv.exe	69
PID 2656 set thread context of 2596	2656	spoolsv.exe	73
PID 1424 set thread context of 2664	1424	spoolsv.exe	77
PID 2124 set thread context of 1760	2124	spoolsv.exe	80
PID 320 set thread context of 356	320	spoolsv.exe	84
PID 1260 set thread context of 588	1260	spoolsv.exe	88
PID 2100 set thread context of 1008	2100	spoolsv.exe	92
PID 2736 set thread context of 2584	2736	spoolsv.exe	96
PID 1684 set thread context of 1000	1684	spoolsv.exe	100
PID 2600 set thread context of 3044	2600	spoolsv.exe	104
PID 2840 set thread context of 2544	2840	spoolsv.exe	108
PID 2348 set thread context of 1716	2348	spoolsv.exe	112
PID 2064 set thread context of 1340	2064	spoolsv.exe	116
PID 2732 set thread context of 2196	2732	spoolsv.exe	120
PID 2740 set thread context of 2940	2740	spoolsv.exe	124
PID 696 set thread context of 2060	696	spoolsv.exe	128
PID 2260 set thread context of 2956	2260	spoolsv.exe	132
PID 2428 set thread context of 1648	2428	spoolsv.exe	136
PID 2164 set thread context of 2032	2164	spoolsv.exe	140
PID 2696 set thread context of 2792	2696	spoolsv.exe	144
PID 2872 set thread context of 1424	2872	spoolsv.exe	148
PID 3068 set thread context of 2432	3068	spoolsv.exe	152
PID 1672 set thread context of 856	1672	spoolsv.exe	156
PID 2468 set thread context of 1448	2468	spoolsv.exe	160
PID 2912 set thread context of 1544	2912	spoolsv.exe	164
PID 1540 set thread context of 2484	1540	spoolsv.exe	168
PID 476 set thread context of 1892	476	spoolsv.exe	172
PID 2136 set thread context of 592	2136	spoolsv.exe	176
PID 1632 set thread context of 448	1632	spoolsv.exe	180
PID 3036 set thread context of 2056	3036	spoolsv.exe	184
PID 2508 set thread context of 3064	2508	spoolsv.exe	192
PID 2508 set thread context of 2152	2508	spoolsv.exe	193
PID 1040 set thread context of 2952	1040	spoolsv.exe	197
PID 2568 set thread context of 2784	2568	explorer.exe	198
PID 2816 set thread context of 2992	2816	spoolsv.exe	201
PID 2816 set thread context of 1380	2816	spoolsv.exe	202
PID 2136 set thread context of 1868	2136	spoolsv.exe	204
PID 1228 set thread context of 2540	1228	spoolsv.exe	207
PID 1228 set thread context of 2488	1228	spoolsv.exe	208
PID 2648 set thread context of 2760	2648	spoolsv.exe	211
PID 1192 set thread context of 2588	1192	spoolsv.exe	213
PID 2988 set thread context of 1376	2988	spoolsv.exe	216
PID 1192 set thread context of 2712	1192	spoolsv.exe	215
PID 2064 set thread context of 948	2064	explorer.exe	214
PID 2988 set thread context of 2860	2988	spoolsv.exe	217
PID 2000 set thread context of 2136	2000	spoolsv.exe	221
PID 1804 set thread context of 844	1804	spoolsv.exe	224
PID 1804 set thread context of 1736	1804	spoolsv.exe	225
PID 2624 set thread context of 1316	2624	spoolsv.exe	228
PID 2520 set thread context of 2232	2520	spoolsv.exe	233
PID 2520 set thread context of 2848	2520	spoolsv.exe	234
PID 2924 set thread context of 2636	2924	explorer.exe	236

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2436-2-0x0000000001D60000-0x0000000001DA6000-memory.dmp	upx
behavioral1/memory/2436-42-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x00080000000174b4-87.dat	upx
behavioral1/memory/1948-95-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x0008000000016f02-166.dat	upx
behavioral1/files/0x000a000000016f02-182.dat	upx
behavioral1/memory/1856-238-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2680-246-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3056-299-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2312-352-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/824-403-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1984-455-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1548-507-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1484-506-0x00000000028D0000-0x0000000002916000-memory.dmp	upx
behavioral1/memory/1548-528-0x00000000004D0000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/2656-563-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1424-619-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1484-640-0x00000000028D0000-0x0000000002916000-memory.dmp	upx
behavioral1/memory/2124-674-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1484-720-0x00000000028D0000-0x0000000002916000-memory.dmp	upx
behavioral1/memory/320-723-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1260-773-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2100-823-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2736-871-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1684-920-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2600-968-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2840-1017-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2348-1065-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2064-1113-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2732-1162-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2740-1207-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/696-1258-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2260-1308-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2428-1355-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2164-1406-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2696-1456-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2872-1506-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3068-1556-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1672-1608-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
1948	explorer.exe
1856	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2680	spoolsv.exe
1484	explorer.exe
3056	spoolsv.exe
1484	explorer.exe
2312	spoolsv.exe
1484	explorer.exe
824	spoolsv.exe
1484	explorer.exe
1984	spoolsv.exe
1484	explorer.exe
1548	spoolsv.exe
1484	explorer.exe
2656	spoolsv.exe
1484	explorer.exe
1424	spoolsv.exe
1484	explorer.exe
2124	spoolsv.exe
1484	explorer.exe
320	spoolsv.exe
1484	explorer.exe
1260	spoolsv.exe
1484	explorer.exe
2100	spoolsv.exe
1484	explorer.exe
2736	spoolsv.exe
1484	explorer.exe
1684	spoolsv.exe
1484	explorer.exe
2600	spoolsv.exe
1484	explorer.exe
2840	spoolsv.exe
1484	explorer.exe
2348	spoolsv.exe
1484	explorer.exe
2064	spoolsv.exe
1484	explorer.exe
2732	spoolsv.exe
1484	explorer.exe
2740	spoolsv.exe
1484	explorer.exe
696	spoolsv.exe
1484	explorer.exe
2260	spoolsv.exe
1484	explorer.exe
2428	spoolsv.exe
1484	explorer.exe
2164	spoolsv.exe
1484	explorer.exe
2696	spoolsv.exe
1484	explorer.exe
2872	spoolsv.exe
1484	explorer.exe
3068	spoolsv.exe
1484	explorer.exe
1672	spoolsv.exe
1484	explorer.exe
2468	spoolsv.exe
1484	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
1948	explorer.exe
1948	explorer.exe
1484	explorer.exe
1484	explorer.exe
1856	spoolsv.exe
1856	spoolsv.exe
1484	explorer.exe
1484	explorer.exe
2680	spoolsv.exe
2680	spoolsv.exe
3056	spoolsv.exe
3056	spoolsv.exe
2312	spoolsv.exe
2312	spoolsv.exe
824	spoolsv.exe
824	spoolsv.exe
1984	spoolsv.exe
1984	spoolsv.exe
1548	spoolsv.exe
1548	spoolsv.exe
2656	spoolsv.exe
2656	spoolsv.exe
1424	spoolsv.exe
1424	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
320	spoolsv.exe
320	spoolsv.exe
1260	spoolsv.exe
1260	spoolsv.exe
2100	spoolsv.exe
2100	spoolsv.exe
2736	spoolsv.exe
2736	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
2600	spoolsv.exe
2600	spoolsv.exe
2840	spoolsv.exe
2840	spoolsv.exe
2348	spoolsv.exe
2348	spoolsv.exe
2064	spoolsv.exe
2064	spoolsv.exe
2732	spoolsv.exe
2732	spoolsv.exe
2740	spoolsv.exe
2740	spoolsv.exe
696	spoolsv.exe
696	spoolsv.exe
2260	spoolsv.exe
2260	spoolsv.exe
2428	spoolsv.exe
2428	spoolsv.exe
2164	spoolsv.exe
2164	spoolsv.exe
2696	spoolsv.exe
2696	spoolsv.exe
2872	spoolsv.exe
2872	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1340	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	31
PID 2436 wrote to memory of 1340	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	31
PID 2436 wrote to memory of 1340	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	31
PID 2436 wrote to memory of 1340	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	31
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2436 wrote to memory of 2764	2436	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	33
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 2876	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	34
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2764 wrote to memory of 1220	2764	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	35
PID 2876 wrote to memory of 1948	2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	36
PID 2876 wrote to memory of 1948	2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	36
PID 2876 wrote to memory of 1948	2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	36
PID 2876 wrote to memory of 1948	2876	842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe	36
PID 1948 wrote to memory of 1944	1948	explorer.exe	37
PID 1948 wrote to memory of 1944	1948	explorer.exe	37
PID 1948 wrote to memory of 1944	1948	explorer.exe	37
PID 1948 wrote to memory of 1944	1948	explorer.exe	37
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39
PID 1948 wrote to memory of 1932	1948	explorer.exe	39

C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
"C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
  C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
    C:\Users\Admin\AppData\Local\Temp\842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1944
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1932
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2500
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2508
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2152
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2720
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2816
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1380
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        
        PID:2628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:948
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2488
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2124
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2712
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1500
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2988
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2860
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1804
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1736
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2360
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2520
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2896
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2596
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:1956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Drops file in Windows directory
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        
        PID:1420
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2104
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2580
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2664
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:1056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1608
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:2928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:668
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2224
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:356
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:3020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Drops file in Windows directory
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Drops startup file
        
        PID:1260
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:2552
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:332
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:588
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:920
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1528
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1876
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1808
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1716
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1340
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2436
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1060
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2060
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1968
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2956
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:1740
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:1648
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2812
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2792
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:680
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:3020
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2432
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:856
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2004
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2484
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:800
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1892
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2516
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:592
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2456
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2364
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2688
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2952
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:696
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1460
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:2128
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        
        PID:1756
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:1316
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:476
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2072
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2228
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2444
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        
        PID:2600
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Drops file in Windows directory
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Drops startup file
        
        PID:2352
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2416
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
80a5d11403897e71333963a7055d233b

SHA1
4e5a243787b0e1f806457ab39a2a8df78f576f67

SHA256
842947611429aab641eb5ba1ec7a4f95be58320e24d862131ddc2ace433beaee

SHA512
32c0e43e3962dd7762e83ad590e678a4ef93969bc36b5d53f5237ce069290ad896d3475fab12abed3b0726d14f29397ba93065a9f50d465e55bf8ca0017bc0b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
\Windows\system\explorer.exe

Filesize
2.9MB

MD5
8ed399fc2b5eb23d73108794a84097db

SHA1
faeb2a808d9c28340085718383fbb570067b27a4

SHA256
b2eb927d62f6bcbc024c51f244ef1eb1aa1fb4a04ca0e7d8ef1a483f087bee5c

SHA512
944de845eef6348b7b272da1b35e6fa846e48b98a925ec1aa771636f5a3bfadd8d6bb42159fa66a64cbb1dfc3e0773ecf66342b7bd2e42b2d2eff9caff4ad8ee

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
b58764a0d023e7b9bc3638d26ec985e0

SHA1
bde917212133472e5d78767252d62624d3c7c5e0

SHA256
97ccfdc14782620e5b68bff706c54fba6e13b0a619d23c9096c7c5c98df49366

SHA512
215e1e71beaef6f073d3ff8e5fa75cb441da13d7d5b41fb5bca44ab5f6403da426aee72f06e15334cf67023a2e42ab0b517d83969aa2bd64e988319f3431c38c

Download Submit
memory/320-723-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/320-729-0x0000000000280000-0x00000000002C6000-memory.dmp

Filesize
280KB

Download
memory/356-769-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/588-818-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/696-1258-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/696-1266-0x0000000001C70000-0x0000000001CB6000-memory.dmp

Filesize
280KB

Download
memory/824-403-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1000-964-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-1455-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1192-396-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1220-86-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1220-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1228-1404-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1260-773-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1340-1161-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1424-619-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1484-300-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1405-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-724-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-640-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1064-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-617-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-967-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-618-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1555-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-870-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-828-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-822-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-720-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-562-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1523-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-454-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1472-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1606-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-188-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-774-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-506-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-772-0x00000000028D0000-0x0000000002916000-memory.dmp

Filesize
280KB

Download
memory/1484-1213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-507-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1548-528-0x00000000004D0000-0x0000000000516000-memory.dmp

Filesize
280KB

Download
memory/1672-1608-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1684-920-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1716-1111-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1760-721-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1804-502-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1856-238-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1932-176-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1932-147-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1948-95-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-455-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2032-1454-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2060-1304-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2064-1113-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2100-823-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2124-674-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2164-1406-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2164-1421-0x00000000005E0000-0x0000000000626000-memory.dmp

Filesize
280KB

Download
memory/2260-1308-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2312-352-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2348-1065-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2428-1355-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2432-1607-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2436-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2436-42-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2436-2-0x0000000001D60000-0x0000000001DA6000-memory.dmp

Filesize
280KB

Download
memory/2508-1307-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2508-242-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2520-558-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2544-1063-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2584-916-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2596-613-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2600-968-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2656-563-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2664-673-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2680-246-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2696-1473-0x0000000001D20000-0x0000000001D66000-memory.dmp

Filesize
280KB

Download
memory/2696-1456-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2732-1162-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2736-871-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2740-1207-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2740-1217-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/2764-36-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-18-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-3-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2764-5-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-10-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-12-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-7-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-48-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2764-49-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2764-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-20-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-28-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-81-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2764-30-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-47-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2764-43-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-44-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2764-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-41-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2764-22-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-39-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-32-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2764-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2816-292-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2816-1354-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2840-1017-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2872-1506-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2876-146-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-94-0x0000000003100000-0x0000000003146000-memory.dmp

Filesize
280KB

Download
memory/2876-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-69-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2940-1257-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2988-446-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2988-1505-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3044-1014-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3056-299-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3068-1556-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download