mofksys | fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
Size 2.9MB
Sample260930-lpb8zaxbqa
SHA256 fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da
MD5 f249347c1d76d62c8b2c7bba26286315
SHA1 fe305cd475ce54404d14ca2e32e2577a626cc4ae
SHA512 27b4501bfa070240319994fab3fac6486adc56f98ec197dd860ba25c57de3248838f81c43d87fb4fecd943463ddd6786eab872b3bcc1b0ed3140fcd21c11bf98
SSDEEP 24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHv:3Ty7A3mw4gxeOw46fUbNecCCFbNeci
TLSH
T157D59ED5B76D149BE11A5571E80F921482DCBCBE93005B9FAB3F69CA90DB0D1D2823CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution mofksys warzonerat infostealer persistence privilege_escalation rat worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys
Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Detects Mofksys worm 6 IoCs

resource	yara_rule
behavioral1/memory/3612-16-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral1/memory/3612-20-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral1/memory/3612-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral1/memory/3760-75-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral1/memory/452-135-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys
behavioral1/memory/3760-154-0x0000000000400000-0x000000000043E000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000024772-33.dat	warzonerat
behavioral1/files/0x000700000002476f-36.dat	warzonerat
behavioral1/files/0x000800000002477a-92.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Creates a file in the Startup directory 1 TTPs 22 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 59 IoCs

pid	Process
5012	StikyNot.exe
3948	explorer.exe
4300	explorer.exe
4680	StikyNot.exe
3760	explorer.exe
452	StikyNot.exe
2068	spoolsv.exe
5216	explorer.exe
4448	spoolsv.exe
4288	spoolsv.exe
2400	SyncHost.exe
3632	explorer.exe
4204	SyncHost.exe
1972	spoolsv.exe
3316	spoolsv.exe
2580	spoolsv.exe
4200	spoolsv.exe
1848	spoolsv.exe
3820	spoolsv.exe
5600	spoolsv.exe
4140	spoolsv.exe
4160	spoolsv.exe
4120	spoolsv.exe
1260	spoolsv.exe
1692	spoolsv.exe
3288	spoolsv.exe
3952	spoolsv.exe
5848	spoolsv.exe
2012	spoolsv.exe
4420	spoolsv.exe
1272	spoolsv.exe
3208	spoolsv.exe
4472	explorer.exe
2052	spoolsv.exe
5092	explorer.exe
5528	spoolsv.exe
6076	spoolsv.exe
5776	spoolsv.exe
1324	explorer.exe
4724	spoolsv.exe
3308	spoolsv.exe
5596	SyncHost.exe
2764	explorer.exe
4556	spoolsv.exe
804	spoolsv.exe
2916	explorer.exe
5916	spoolsv.exe
908	spoolsv.exe
3616	spoolsv.exe
2712	spoolsv.exe
1192	spoolsv.exe
3780	spoolsv.exe
5096	spoolsv.exe
5660	spoolsv.exe
2912	spoolsv.exe
4968	spoolsv.exe
2352	spoolsv.exe
5100	spoolsv.exe
4324	spoolsv.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	StikyNot.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	SyncHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	explorer.exe

Suspicious use of SetThreadContext 40 IoCs

description	pid	Process	procid_target
PID 4344 set thread context of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 364 set thread context of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 set thread context of 4628	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	108
PID 3948 set thread context of 4300	3948	explorer.exe	116
PID 5012 set thread context of 4680	5012	StikyNot.exe	117
PID 4300 set thread context of 3760	4300	explorer.exe	120
PID 4300 set thread context of 5716	4300	explorer.exe	121
PID 4680 set thread context of 452	4680	StikyNot.exe	122
PID 4680 set thread context of 4496	4680	StikyNot.exe	124
PID 2068 set thread context of 4448	2068	spoolsv.exe	129
PID 5216 set thread context of 3632	5216	explorer.exe	138
PID 2400 set thread context of 4204	2400	SyncHost.exe	137
PID 4288 set thread context of 1972	4288	spoolsv.exe	142
PID 3316 set thread context of 2580	3316	spoolsv.exe	146
PID 4200 set thread context of 1848	4200	spoolsv.exe	151
PID 3820 set thread context of 5600	3820	spoolsv.exe	157
PID 4140 set thread context of 4160	4140	spoolsv.exe	161
PID 4120 set thread context of 1260	4120	spoolsv.exe	165
PID 1692 set thread context of 3288	1692	spoolsv.exe	169
PID 3952 set thread context of 5848	3952	spoolsv.exe	173
PID 2012 set thread context of 4420	2012	spoolsv.exe	177
PID 4448 set thread context of 1272	4448	spoolsv.exe	178
PID 4448 set thread context of 4596	4448	spoolsv.exe	179
PID 3208 set thread context of 2052	3208	spoolsv.exe	186
PID 4472 set thread context of 5092	4472	explorer.exe	187
PID 5528 set thread context of 6076	5528	spoolsv.exe	191
PID 3632 set thread context of 1324	3632	explorer.exe	195
PID 3632 set thread context of 2652	3632	explorer.exe	196
PID 5776 set thread context of 4724	5776	spoolsv.exe	197
PID 4204 set thread context of 5596	4204	SyncHost.exe	200
PID 4204 set thread context of 3740	4204	SyncHost.exe	201
PID 3308 set thread context of 4556	3308	spoolsv.exe	206
PID 2764 set thread context of 2916	2764	explorer.exe	208
PID 804 set thread context of 5916	804	spoolsv.exe	211
PID 908 set thread context of 3616	908	spoolsv.exe	215
PID 2712 set thread context of 1192	2712	spoolsv.exe	219
PID 3780 set thread context of 5096	3780	spoolsv.exe	223
PID 5660 set thread context of 2912	5660	spoolsv.exe	227
PID 4968 set thread context of 2352	4968	spoolsv.exe	231
PID 5100 set thread context of 4324	5100	spoolsv.exe	235

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3216	cmd.exe
5772	cmd.exe
5868	cmd.exe
3168	cmd.exe
2352	cmd.exe
3324	cmd.exe
3744	cmd.exe
1916	cmd.exe
1984	cmd.exe
1188	cmd.exe
6044	cmd.exe
2932	cmd.exe
5472	cmd.exe
2648	cmd.exe
4460	cmd.exe
4180	cmd.exe
5728	cmd.exe
2976	cmd.exe
5884	cmd.exe
5180	cmd.exe
6024	cmd.exe
4176	cmd.exe
628	cmd.exe
5016	cmd.exe
4132	cmd.exe
6040	cmd.exe
436	cmd.exe
2352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StikyNot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SyncHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SyncHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SyncHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
3612	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
3612	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
3948	explorer.exe
3948	explorer.exe
5012	StikyNot.exe
5012	StikyNot.exe
2068	spoolsv.exe
2068	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
3760	explorer.exe
3760	explorer.exe
2400	SyncHost.exe
2400	SyncHost.exe
5216	explorer.exe
5216	explorer.exe
4288	spoolsv.exe
4288	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
3316	spoolsv.exe
3316	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
4200	spoolsv.exe
4200	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
3820	spoolsv.exe
3820	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
4140	spoolsv.exe
4140	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
4120	spoolsv.exe
4120	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
1692	spoolsv.exe
1692	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
3952	spoolsv.exe
3952	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
2012	spoolsv.exe
2012	spoolsv.exe
3760	explorer.exe
3760	explorer.exe
3208	spoolsv.exe
3208	spoolsv.exe
4472	explorer.exe
4472	explorer.exe
3760	explorer.exe
3760	explorer.exe
5528	spoolsv.exe
5528	spoolsv.exe
3760	explorer.exe
3760	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
3612	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
3612	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
5012	StikyNot.exe
5012	StikyNot.exe
3948	explorer.exe
3948	explorer.exe
3760	explorer.exe
3760	explorer.exe
2068	spoolsv.exe
2068	spoolsv.exe
452	StikyNot.exe
452	StikyNot.exe
5216	explorer.exe
5216	explorer.exe
3760	explorer.exe
3760	explorer.exe
4288	spoolsv.exe
4288	spoolsv.exe
2400	SyncHost.exe
2400	SyncHost.exe
3316	spoolsv.exe
3316	spoolsv.exe
4200	spoolsv.exe
4200	spoolsv.exe
3820	spoolsv.exe
3820	spoolsv.exe
4140	spoolsv.exe
4140	spoolsv.exe
4120	spoolsv.exe
4120	spoolsv.exe
1692	spoolsv.exe
1692	spoolsv.exe
3952	spoolsv.exe
3952	spoolsv.exe
2012	spoolsv.exe
2012	spoolsv.exe
1272	spoolsv.exe
1272	spoolsv.exe
3208	spoolsv.exe
3208	spoolsv.exe
4472	explorer.exe
4472	explorer.exe
5528	spoolsv.exe
5528	spoolsv.exe
5776	spoolsv.exe
5776	spoolsv.exe
1324	explorer.exe
1324	explorer.exe
3308	spoolsv.exe
3308	spoolsv.exe
5596	SyncHost.exe
5596	SyncHost.exe
2764	explorer.exe
2764	explorer.exe
804	spoolsv.exe
804	spoolsv.exe
908	spoolsv.exe
908	spoolsv.exe
2712	spoolsv.exe
2712	spoolsv.exe
3780	spoolsv.exe
3780	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3168	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	89
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 4344 wrote to memory of 364	4344	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	92
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 3612	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	107
PID 364 wrote to memory of 4628	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	108
PID 364 wrote to memory of 4628	364	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	108
PID 3612 wrote to memory of 3948	3612	jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe	110
PID 3948 wrote to memory of 5016	3948	explorer.exe	112
PID 5012 wrote to memory of 2352	5012	StikyNot.exe	114
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 3948 wrote to memory of 4300	3948	explorer.exe	116
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 5012 wrote to memory of 4680	5012	StikyNot.exe	117
PID 4300 wrote to memory of 3760	4300	explorer.exe	120
PID 4300 wrote to memory of 3760	4300	explorer.exe	120
PID 4300 wrote to memory of 3760	4300	explorer.exe	120
PID 4300 wrote to memory of 3760	4300	explorer.exe	120

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da.exe
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        
        PID:5016
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3760
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Executes a command shell one-liner
        
        PID:4132
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4448
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1272
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        11⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        9⤵
        
        PID:4596
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Executes a command shell one-liner
        
        PID:2648
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2580
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Executes a command shell one-liner
        
        PID:3324
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Executes a command shell one-liner
        
        PID:436
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:5600
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        
        PID:2352
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:4160
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        
        PID:4460
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:3616
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:2912
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:628
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        8⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe
        8⤵
        Executes dropped EXE
        
        PID:4324
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:5716
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:4628

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:2352
- C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
  C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  PID:4680
- - C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
    C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:452
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5216
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Creates a file in the Startup directory
        Executes a command shell one-liner
        
        PID:2932
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3632
      - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2652
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:4496

C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5472
- C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
  C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4204
- - C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
    C:\Users\Admin\AppData\Local\Chrome\SyncHost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5596
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        5⤵
        Executes a command shell one-liner
        
        PID:6024
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        
        PID:2916
- - C:\Windows\SysWOW64\diskperf.exe
    "C:\Windows\SysWOW64\diskperf.exe"
    3⤵
    PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StikyNot.exe

Path C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe
Size 2.9MB
SHA256 fd4a53e962e90729846991d4e151ea701c2eb7b66e84c432aa35cdaf309a55da
MD5 f249347c1d76d62c8b2c7bba26286315
SHA1 fe305cd475ce54404d14ca2e32e2577a626cc4ae
SHA512 27b4501bfa070240319994fab3fac6486adc56f98ec197dd860ba25c57de3248838f81c43d87fb4fecd943463ddd6786eab872b3bcc1b0ed3140fcd21c11bf98
SSDEEP 24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHv:3Ty7A3mw4gxeOw46fUbNecCCFbNeci
TLSH
T157D59ED5B76D149BE11A5571E80F921482DCBCBE93005B9FAB3F69CA90DB0D1D2823CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
Size 111B
SHA256 b344512b65cae99d355e35471c3784117b3612a4c5b7b2862495c4b7609d7f95
MD5 ccd4d45da1ae6ddc9b11daf6723e0385
SHA1 13d6c1ed763836a314e891e3bfdd9fdf5af21027
SHA512 c1736f0c415d2b5532bb3fe39efb2fb2961fb1a6d090d2aa5f08f836b565d1d8a4f81fd70a19f57f619cee1fcaa0fece86de4c4abec538aa3e26a981616959bb
TLSH
T1E6B0124928CBF012623200D80229538AD981ECA35F1C825051CCED4C30D0C374B1EA7E
MD5 SHA1 SHA512 TLSH

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
Size 111B
SHA256 35ba53c6963f7f5febd3cfd124719f4fb6c2d6ee7d5d79e42d73e3483eadf839
MD5 54a02a83fc1a67d1edd9f9b9ee12fceb
SHA1 f3d599ee3911d541d8c582596b2425fce570f568
SHA512 9ec8ce4c57d45e75f3c6035c94f375b99bf7a3dd2afa256f8e8c48f7a18ce4e591d6f4893a4090d2c23022bfe68e23cb74eff928a0c99125f5bb7270bb42af77
TLSH
T123B0120A748BEB1A552580DF02B1528DCDE04CA63D6CF740434CDC4C31D0E29AB4B322
MD5 SHA1 SHA512 TLSH

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
Size 92B
SHA256 d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
MD5 13222a4bb413aaa8b92aa5b4f81d2760
SHA1 268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA512 eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
TLSH
T157B0124E2995E053403201D80236634DC880ECB717108110014CD80830909324B185A9
MD5 SHA1 SHA512 TLSH

Submit Download

x.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
Size 93B
SHA256 5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
MD5 8445bfa5a278e2f068300c604a78394b
SHA1 9fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA512 8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
TLSH
T1C3B01249288BE012503200D802255389C840E8935A1882105188D90830D08324B1996E
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.9MB
SHA256 930283c56d451af90aef66b1ca2857eff2e0308b3d16744b003efb986eb94f47
MD5 710d6ba9eb0ffa8d29bd019eb36f8277
SHA1 b9e94e2fc30171ac53bc7ea79113aefa9e6abd16
SHA512 5880b73c9959df7d89d4662c4e64796be2ec9d7616e6a9f6fcf6ecde96177d429f50dd269c2504cf9d90fb7c4ce73ae8b4d2e076459f95f704aa38306df381fd
SSDEEP 24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHo:3Ty7A3mw4gxeOw46fUbNecCCFbNecZ
TLSH
T18ED5CF81B81EC4ABF72694B2758F50B04BC7EEB447C1775B17327447AAC71A4A8A3783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 2.9MB
SHA256 c995cec586ebdf9b2fa75285a8bb7294ccd2094d9a413c72001f1f4f4f395444
MD5 1614806691006fd7fcdab87e78010173
SHA1 d59990742e7fc497924e931b28f28611e426e3ed
SHA512 0766d30f3faa7a5a3597aa53edaa337bb77158ae67ff32630873628cf4fc55a4f179a1ec00d40d9be49a13d178012b850efa62082d193b8e912b7069cec8c1c7
SSDEEP 24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHB:3Ty7A3mw4gxeOw46fUbNecCCFbNecg
TLSH
T110D5AFD2361A04E3D21398F2E22FB723C5C4779BA780A2AB7B356D459493297D6C3743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-26-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/364-8-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-10-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-12-0x00000000004E7000-0x0000000000513000-memory.dmp

Download

memory/364-11-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-1-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/364-9-0x00000000004E7000-0x0000000000513000-memory.dmp

Download

memory/364-4-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/364-7-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/364-3-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-29-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-2-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-6-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/364-5-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/452-135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1260-223-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1848-184-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1848-182-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1848-180-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1972-150-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/1972-147-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1972-174-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1972-158-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1972-145-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/1972-146-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/1972-148-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/1972-149-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/2580-165-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2580-166-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2580-164-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/2580-176-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/2580-167-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/2580-169-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/2580-168-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/3612-52-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3612-16-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3612-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3632-127-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/3632-323-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/3632-157-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/3632-128-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/3632-125-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/3632-124-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/3632-129-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/3632-126-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/3760-154-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3760-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4160-208-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4160-209-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4160-205-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4160-206-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4160-207-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4160-210-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4204-156-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4204-136-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4204-355-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4204-139-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4204-141-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4300-49-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4300-47-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4300-45-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4300-43-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4300-44-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4300-46-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4300-93-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4300-78-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4300-61-0x0000000000400000-0x0000000001990000-memory.dmp

Download

memory/4448-114-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4448-107-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4448-272-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4448-155-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4448-108-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4448-111-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4448-109-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4448-110-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4628-24-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4628-25-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4628-21-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4680-56-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4680-62-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4680-60-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4680-55-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4680-57-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4680-97-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/4680-58-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4680-101-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/4680-59-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/5600-198-0x0000000000400000-0x0000000000628000-memory.dmp

Download