Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 11:44
Behavioral task
behavioral1
Sample
a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe
Resource
win10v2004-20241007-en
General
-
Target
a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe
-
Size
2.9MB
-
MD5
d1bdeb99a7de91db95783d0f4af6c6d0
-
SHA1
34772f37c36d0a821bc3860c0fa2d4b858f52650
-
SHA256
a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838
-
SHA512
06150bfde172ebe24bbc57676d19411644df9de0367c595caef71ed7a15963d59adb3208a9a011eed836db08e470c660f717a6d9d4f5ff8f2bb3942579a76012
-
SSDEEP
24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHJ:eTy7ASmw4gxeOw46fUbNecCCFbNecu
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral2/files/0x0009000000023cdb-29.dat warzonerat behavioral2/files/0x0008000000023cd9-55.dat warzonerat behavioral2/files/0x0003000000022701-69.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 21 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 42 IoCs
pid Process 4068 explorer.exe 764 explorer.exe 2644 explorer.exe 100 spoolsv.exe 3408 spoolsv.exe 1972 spoolsv.exe 2420 spoolsv.exe 4252 spoolsv.exe 3436 spoolsv.exe 1896 spoolsv.exe 4960 spoolsv.exe 1244 spoolsv.exe 4760 spoolsv.exe 916 spoolsv.exe 1100 spoolsv.exe 3240 spoolsv.exe 4812 spoolsv.exe 2168 spoolsv.exe 4880 spoolsv.exe 4068 spoolsv.exe 496 spoolsv.exe 1120 spoolsv.exe 2520 spoolsv.exe 3692 spoolsv.exe 4340 spoolsv.exe 4912 spoolsv.exe 2516 spoolsv.exe 396 spoolsv.exe 1188 spoolsv.exe 3948 spoolsv.exe 1192 spoolsv.exe 4480 spoolsv.exe 2804 spoolsv.exe 1876 spoolsv.exe 1916 spoolsv.exe 4428 spoolsv.exe 5084 spoolsv.exe 760 spoolsv.exe 4128 spoolsv.exe 2616 spoolsv.exe 2816 spoolsv.exe 2852 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 22 IoCs
description pid Process procid_target PID 2064 set thread context of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 1376 set thread context of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 4068 set thread context of 764 4068 explorer.exe 107 PID 764 set thread context of 2644 764 explorer.exe 108 PID 100 set thread context of 3408 100 spoolsv.exe 113 PID 1972 set thread context of 2420 1972 spoolsv.exe 117 PID 4252 set thread context of 3436 4252 spoolsv.exe 121 PID 1896 set thread context of 4960 1896 spoolsv.exe 125 PID 1244 set thread context of 4760 1244 spoolsv.exe 129 PID 916 set thread context of 1100 916 spoolsv.exe 133 PID 3240 set thread context of 4812 3240 spoolsv.exe 137 PID 2168 set thread context of 4880 2168 spoolsv.exe 141 PID 4068 set thread context of 496 4068 spoolsv.exe 145 PID 1120 set thread context of 2520 1120 spoolsv.exe 149 PID 3692 set thread context of 4340 3692 spoolsv.exe 153 PID 4912 set thread context of 2516 4912 spoolsv.exe 157 PID 3948 set thread context of 1192 3948 spoolsv.exe 165 PID 4480 set thread context of 2804 4480 spoolsv.exe 169 PID 1876 set thread context of 1916 1876 spoolsv.exe 173 PID 4428 set thread context of 5084 4428 spoolsv.exe 177 PID 760 set thread context of 4128 760 spoolsv.exe 181 PID 2616 set thread context of 2816 2616 spoolsv.exe 185 -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4068 explorer.exe 4068 explorer.exe 100 spoolsv.exe 100 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 2644 explorer.exe 2644 explorer.exe 1972 spoolsv.exe 1972 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 4252 spoolsv.exe 4252 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 1896 spoolsv.exe 1896 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 1244 spoolsv.exe 1244 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 916 spoolsv.exe 916 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 3240 spoolsv.exe 3240 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 2168 spoolsv.exe 2168 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 4068 spoolsv.exe 4068 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 1120 spoolsv.exe 1120 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 3692 spoolsv.exe 3692 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 4912 spoolsv.exe 4912 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 2644 explorer.exe 2644 explorer.exe 3948 spoolsv.exe 3948 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 4480 spoolsv.exe 4480 spoolsv.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
pid Process 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 4068 explorer.exe 4068 explorer.exe 2644 explorer.exe 2644 explorer.exe 100 spoolsv.exe 100 spoolsv.exe 2644 explorer.exe 2644 explorer.exe 1972 spoolsv.exe 1972 spoolsv.exe 4252 spoolsv.exe 4252 spoolsv.exe 1896 spoolsv.exe 1896 spoolsv.exe 1244 spoolsv.exe 1244 spoolsv.exe 916 spoolsv.exe 916 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 2168 spoolsv.exe 2168 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 1120 spoolsv.exe 1120 spoolsv.exe 3692 spoolsv.exe 3692 spoolsv.exe 4912 spoolsv.exe 4912 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe 4480 spoolsv.exe 4480 spoolsv.exe 1876 spoolsv.exe 1876 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 760 spoolsv.exe 760 spoolsv.exe 2616 spoolsv.exe 2616 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1972 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 83 PID 2064 wrote to memory of 1972 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 83 PID 2064 wrote to memory of 1972 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 83 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 2064 wrote to memory of 1376 2064 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 85 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 4888 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 102 PID 1376 wrote to memory of 1008 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 103 PID 1376 wrote to memory of 1008 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 103 PID 1376 wrote to memory of 1008 1376 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 103 PID 4888 wrote to memory of 4068 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 104 PID 4888 wrote to memory of 4068 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 104 PID 4888 wrote to memory of 4068 4888 a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe 104 PID 4068 wrote to memory of 2968 4068 explorer.exe 105 PID 4068 wrote to memory of 2968 4068 explorer.exe 105 PID 4068 wrote to memory of 2968 4068 explorer.exe 105 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107 PID 4068 wrote to memory of 764 4068 explorer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe"C:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exeC:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exeC:\Users\Admin\AppData\Local\Temp\a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838N.exe3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2968
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2644 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4704
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1092
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:496
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:624
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4192
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1008
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5d1bdeb99a7de91db95783d0f4af6c6d0
SHA134772f37c36d0a821bc3860c0fa2d4b858f52650
SHA256a46ef15ab8f68de250213a96ad55d476e7f66d8283515c780b35ecfa202a0838
SHA51206150bfde172ebe24bbc57676d19411644df9de0367c595caef71ed7a15963d59adb3208a9a011eed836db08e470c660f717a6d9d4f5ff8f2bb3942579a76012
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD56a9817ad5c5f98780eb7b8c362e8703f
SHA119ea7c38a69bb811af9c9cd8122bb916340f0723
SHA25698075d5165b6d678e64b77eb057ca33ed3934f73fbe893062a0bbfab654b22af
SHA512aa6ffdd55ff80d1971afde25a4e0c94a57edc55a514e7fd043718a341e50bd059be996c8a1b99b28c5707be387a98b32443c95ad9ed4d43d457dae28be1820c5
-
Filesize
2.9MB
MD526f55a21d63fb0c691edf3b93275ce8a
SHA1b2cf97690ab7656151731916bc92df83af09190d
SHA256d5175b7d9a1f19eb2beca50bcdde610f509f9e24b04e593dc65758838325bec8
SHA512eb50d69e28c09282622263c4e11465c6ccda1d8dd255957e54c9ed3dbc055ea8a4392661b8e87e12c20ea9551b3ba1dc8b6f926b2cb35563a5f1780962112d39