Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 21:15
Behavioral task
behavioral1
Sample
001795a3ef48c4087944786735b2757d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
001795a3ef48c4087944786735b2757d_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
001795a3ef48c4087944786735b2757d
-
SHA1
11f83d76658d51e7ccb8ac04bc918a0527f1b29d
-
SHA256
5ebd7cd6db36a110758dfec2d9d7b813f8d9d6212c82ae32764cd9af65520d55
-
SHA512
cd335858c96360beedfdc9b66e418529e5f22460e397695c5e031df2eef00df56bb81d749e1059857f552c1417d541d36f03cf28dfb40b8f900c06f8d59bc4ba
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwJ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2848 explorer.exe 4296 explorer.exe 960 spoolsv.exe 2064 spoolsv.exe 916 spoolsv.exe 2736 spoolsv.exe 4248 spoolsv.exe 3956 spoolsv.exe 4704 spoolsv.exe 2080 spoolsv.exe 1656 spoolsv.exe 3196 spoolsv.exe 3412 spoolsv.exe 4400 spoolsv.exe 3124 spoolsv.exe 948 spoolsv.exe 4804 spoolsv.exe 4608 spoolsv.exe 2912 spoolsv.exe 5028 spoolsv.exe 1492 spoolsv.exe 1556 spoolsv.exe 2272 spoolsv.exe 4768 spoolsv.exe 4132 spoolsv.exe 4284 spoolsv.exe 2852 spoolsv.exe 2000 spoolsv.exe 2560 spoolsv.exe 5188 spoolsv.exe 5560 spoolsv.exe 5884 spoolsv.exe 392 spoolsv.exe 5472 spoolsv.exe 5784 spoolsv.exe 1900 spoolsv.exe 4024 spoolsv.exe 5844 spoolsv.exe 5244 spoolsv.exe 5752 spoolsv.exe 5184 spoolsv.exe 5680 spoolsv.exe 3220 spoolsv.exe 5644 spoolsv.exe 5628 spoolsv.exe 4324 explorer.exe 6064 spoolsv.exe 6140 spoolsv.exe 4956 spoolsv.exe 5524 spoolsv.exe 6024 spoolsv.exe 5956 spoolsv.exe 5760 spoolsv.exe 1236 spoolsv.exe 2896 spoolsv.exe 1356 spoolsv.exe 5024 spoolsv.exe 5936 spoolsv.exe 6108 spoolsv.exe 1168 spoolsv.exe 6044 spoolsv.exe 5900 spoolsv.exe 5140 spoolsv.exe 4760 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 44 IoCs
description pid Process procid_target PID 4324 set thread context of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 2848 set thread context of 4296 2848 explorer.exe 101 PID 960 set thread context of 5628 960 spoolsv.exe 150 PID 2064 set thread context of 6064 2064 spoolsv.exe 152 PID 916 set thread context of 6140 916 spoolsv.exe 153 PID 2736 set thread context of 4956 2736 spoolsv.exe 154 PID 4248 set thread context of 5524 4248 spoolsv.exe 155 PID 3956 set thread context of 6024 3956 spoolsv.exe 156 PID 4704 set thread context of 5760 4704 spoolsv.exe 158 PID 2080 set thread context of 1236 2080 spoolsv.exe 159 PID 1656 set thread context of 2896 1656 spoolsv.exe 160 PID 3196 set thread context of 1356 3196 spoolsv.exe 161 PID 3412 set thread context of 5024 3412 spoolsv.exe 162 PID 4400 set thread context of 5936 4400 spoolsv.exe 163 PID 948 set thread context of 6108 948 spoolsv.exe 165 PID 4804 set thread context of 1168 4804 spoolsv.exe 166 PID 3124 set thread context of 6044 3124 spoolsv.exe 164 PID 4608 set thread context of 5900 4608 spoolsv.exe 167 PID 2912 set thread context of 4760 2912 spoolsv.exe 168 PID 5028 set thread context of 684 5028 spoolsv.exe 170 PID 3220 set thread context of 5300 3220 spoolsv.exe 172 PID 1556 set thread context of 5164 1556 spoolsv.exe 173 PID 4284 set thread context of 2380 4284 spoolsv.exe 177 PID 2272 set thread context of 5412 2272 spoolsv.exe 174 PID 4768 set thread context of 5316 4768 spoolsv.exe 175 PID 1492 set thread context of 5256 1492 spoolsv.exe 171 PID 4132 set thread context of 4320 4132 spoolsv.exe 176 PID 2852 set thread context of 3484 2852 spoolsv.exe 178 PID 2000 set thread context of 2460 2000 spoolsv.exe 179 PID 2560 set thread context of 4392 2560 spoolsv.exe 180 PID 5188 set thread context of 4964 5188 spoolsv.exe 181 PID 5884 set thread context of 5080 5884 spoolsv.exe 182 PID 5560 set thread context of 3284 5560 spoolsv.exe 183 PID 392 set thread context of 5092 392 spoolsv.exe 185 PID 5472 set thread context of 5512 5472 spoolsv.exe 186 PID 5784 set thread context of 3392 5784 spoolsv.exe 187 PID 5844 set thread context of 4224 5844 spoolsv.exe 189 PID 4024 set thread context of 3568 4024 spoolsv.exe 190 PID 1900 set thread context of 5624 1900 spoolsv.exe 191 PID 5244 set thread context of 4100 5244 spoolsv.exe 192 PID 5752 set thread context of 5376 5752 spoolsv.exe 193 PID 5680 set thread context of 4092 5680 spoolsv.exe 195 PID 5184 set thread context of 1984 5184 spoolsv.exe 194 PID 5644 set thread context of 2904 5644 spoolsv.exe 220 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4296 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 5628 spoolsv.exe 5628 spoolsv.exe 6064 spoolsv.exe 6064 spoolsv.exe 6140 spoolsv.exe 6140 spoolsv.exe 4956 spoolsv.exe 4956 spoolsv.exe 5524 spoolsv.exe 5524 spoolsv.exe 6024 spoolsv.exe 6024 spoolsv.exe 5760 spoolsv.exe 5760 spoolsv.exe 1236 spoolsv.exe 2896 spoolsv.exe 1236 spoolsv.exe 2896 spoolsv.exe 1356 spoolsv.exe 5024 spoolsv.exe 5936 spoolsv.exe 1356 spoolsv.exe 5024 spoolsv.exe 5936 spoolsv.exe 6108 spoolsv.exe 1168 spoolsv.exe 6044 spoolsv.exe 5900 spoolsv.exe 6044 spoolsv.exe 1168 spoolsv.exe 6108 spoolsv.exe 5900 spoolsv.exe 4760 spoolsv.exe 4760 spoolsv.exe 684 spoolsv.exe 5300 spoolsv.exe 684 spoolsv.exe 5164 spoolsv.exe 5300 spoolsv.exe 2380 spoolsv.exe 5164 spoolsv.exe 4320 spoolsv.exe 5256 spoolsv.exe 5412 spoolsv.exe 5316 spoolsv.exe 2460 spoolsv.exe 2380 spoolsv.exe 5256 spoolsv.exe 5412 spoolsv.exe 3484 spoolsv.exe 5316 spoolsv.exe 4320 spoolsv.exe 4392 spoolsv.exe 2460 spoolsv.exe 3484 spoolsv.exe 4964 spoolsv.exe 4392 spoolsv.exe 3284 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3172 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 85 PID 4324 wrote to memory of 3172 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 85 PID 4324 wrote to memory of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 4324 wrote to memory of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 4324 wrote to memory of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 4324 wrote to memory of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 4324 wrote to memory of 4220 4324 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 97 PID 4220 wrote to memory of 2848 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 98 PID 4220 wrote to memory of 2848 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 98 PID 4220 wrote to memory of 2848 4220 001795a3ef48c4087944786735b2757d_JaffaCakes118.exe 98 PID 2848 wrote to memory of 4296 2848 explorer.exe 101 PID 2848 wrote to memory of 4296 2848 explorer.exe 101 PID 2848 wrote to memory of 4296 2848 explorer.exe 101 PID 2848 wrote to memory of 4296 2848 explorer.exe 101 PID 2848 wrote to memory of 4296 2848 explorer.exe 101 PID 4296 wrote to memory of 960 4296 explorer.exe 102 PID 4296 wrote to memory of 960 4296 explorer.exe 102 PID 4296 wrote to memory of 960 4296 explorer.exe 102 PID 4296 wrote to memory of 2064 4296 explorer.exe 103 PID 4296 wrote to memory of 2064 4296 explorer.exe 103 PID 4296 wrote to memory of 2064 4296 explorer.exe 103 PID 4296 wrote to memory of 916 4296 explorer.exe 104 PID 4296 wrote to memory of 916 4296 explorer.exe 104 PID 4296 wrote to memory of 916 4296 explorer.exe 104 PID 4296 wrote to memory of 2736 4296 explorer.exe 105 PID 4296 wrote to memory of 2736 4296 explorer.exe 105 PID 4296 wrote to memory of 2736 4296 explorer.exe 105 PID 4296 wrote to memory of 4248 4296 explorer.exe 106 PID 4296 wrote to memory of 4248 4296 explorer.exe 106 PID 4296 wrote to memory of 4248 4296 explorer.exe 106 PID 4296 wrote to memory of 3956 4296 explorer.exe 107 PID 4296 wrote to memory of 3956 4296 explorer.exe 107 PID 4296 wrote to memory of 3956 4296 explorer.exe 107 PID 4296 wrote to memory of 4704 4296 explorer.exe 108 PID 4296 wrote to memory of 4704 4296 explorer.exe 108 PID 4296 wrote to memory of 4704 4296 explorer.exe 108 PID 4296 wrote to memory of 2080 4296 explorer.exe 109 PID 4296 wrote to memory of 2080 4296 explorer.exe 109 PID 4296 wrote to memory of 2080 4296 explorer.exe 109 PID 4296 wrote to memory of 1656 4296 explorer.exe 110 PID 4296 wrote to memory of 1656 4296 explorer.exe 110 PID 4296 wrote to memory of 1656 4296 explorer.exe 110 PID 4296 wrote to memory of 3196 4296 explorer.exe 111 PID 4296 wrote to memory of 3196 4296 explorer.exe 111 PID 4296 wrote to memory of 3196 4296 explorer.exe 111 PID 4296 wrote to memory of 3412 4296 explorer.exe 112 PID 4296 wrote to memory of 3412 4296 explorer.exe 112 PID 4296 wrote to memory of 3412 4296 explorer.exe 112 PID 4296 wrote to memory of 4400 4296 explorer.exe 113 PID 4296 wrote to memory of 4400 4296 explorer.exe 113 PID 4296 wrote to memory of 4400 4296 explorer.exe 113 PID 4296 wrote to memory of 3124 4296 explorer.exe 114 PID 4296 wrote to memory of 3124 4296 explorer.exe 114 PID 4296 wrote to memory of 3124 4296 explorer.exe 114 PID 4296 wrote to memory of 948 4296 explorer.exe 115 PID 4296 wrote to memory of 948 4296 explorer.exe 115 PID 4296 wrote to memory of 948 4296 explorer.exe 115 PID 4296 wrote to memory of 4804 4296 explorer.exe 116 PID 4296 wrote to memory of 4804 4296 explorer.exe 116 PID 4296 wrote to memory of 4804 4296 explorer.exe 116 PID 4296 wrote to memory of 4608 4296 explorer.exe 117 PID 4296 wrote to memory of 4608 4296 explorer.exe 117 PID 4296 wrote to memory of 4608 4296 explorer.exe 117 PID 4296 wrote to memory of 2912 4296 explorer.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\001795a3ef48c4087944786735b2757d_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4324
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6140
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4956
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5524
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5936
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5164
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5188 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5512
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3568
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5300
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2904
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4352
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6084
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:60
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6120
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5580
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4908
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1864
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52dc9648a887832a1356c7380bbb7b058
SHA1fe2afed460b5821d7aed38a768a8576a6e02c2cb
SHA256b4f8f562d5fca690b48c52b889e4cf629d2c4d6f954f14504f4aa07e26b896ec
SHA5120e93c76ec15d7e97432b3c9773498a07137f40a7fbca76c17eb8d043e6c517ba340c45eb68ded187ab4eac40ae93ebc85c91c87476f6a8517b55f214d045de7d
-
Filesize
2.2MB
MD57a3112ce72dfcb7ef13154732d480221
SHA16d59a0b7c70128a73bfa2a2bf318b2f2b3b33142
SHA256b9961cce3a7ea2264ddfcb2998998d886c8d4ba74e26b389b2ab0fd339dbe934
SHA512bb8bbd469389bb14a5e3cb8003ba097cfd88a6c7b1ef58dfa312108365fd7bef60773bbd83f03faa262c891d50978ba35386cd898bfe4225c633d7cabade2cc0