Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 21:09
Behavioral task
behavioral1
Sample
0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0014cb2974a8f2ea528843b3310e0a69
-
SHA1
f452c3a22e4de324c80bc2dbb15f285853eb6a02
-
SHA256
00a605dd0c4989ff8e81145406fb46c67891acdf98dd8c7f9597206e03ad9343
-
SHA512
34c474c3948720e15d95933894176c22377e61e7a4588a763d89e568e16d7af99c2190c99a8ccf19ac57c374e338a98d27af494535a152e01c9a059213de211b
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ6:0UzeyQMS4DqodCnoe+iitjWww+
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3108 explorer.exe 4868 explorer.exe 60 spoolsv.exe 344 spoolsv.exe 1576 spoolsv.exe 456 spoolsv.exe 4672 spoolsv.exe 3276 spoolsv.exe 2080 spoolsv.exe 4144 spoolsv.exe 744 spoolsv.exe 3184 spoolsv.exe 1048 spoolsv.exe 4216 spoolsv.exe 3108 spoolsv.exe 5016 spoolsv.exe 4520 spoolsv.exe 3856 spoolsv.exe 2296 spoolsv.exe 4976 spoolsv.exe 388 spoolsv.exe 3864 spoolsv.exe 3180 spoolsv.exe 1220 spoolsv.exe 5192 spoolsv.exe 5544 spoolsv.exe 5844 spoolsv.exe 340 spoolsv.exe 5452 spoolsv.exe 5828 spoolsv.exe 5140 spoolsv.exe 2244 spoolsv.exe 5584 spoolsv.exe 5168 spoolsv.exe 5380 spoolsv.exe 6068 spoolsv.exe 5440 spoolsv.exe 5320 spoolsv.exe 5668 explorer.exe 5680 spoolsv.exe 6008 spoolsv.exe 6104 spoolsv.exe 1704 spoolsv.exe 4280 spoolsv.exe 5372 spoolsv.exe 5540 spoolsv.exe 1844 spoolsv.exe 5768 spoolsv.exe 4984 spoolsv.exe 4496 explorer.exe 1776 spoolsv.exe 1528 spoolsv.exe 6072 spoolsv.exe 1768 spoolsv.exe 5940 spoolsv.exe 4924 spoolsv.exe 5228 spoolsv.exe 5236 spoolsv.exe 1424 spoolsv.exe 5424 spoolsv.exe 3628 spoolsv.exe 4764 spoolsv.exe 2444 spoolsv.exe 1596 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 37 IoCs
description pid Process procid_target PID 1612 set thread context of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 3108 set thread context of 4868 3108 explorer.exe 107 PID 60 set thread context of 5320 60 spoolsv.exe 148 PID 344 set thread context of 5680 344 spoolsv.exe 150 PID 1576 set thread context of 6008 1576 spoolsv.exe 151 PID 456 set thread context of 6104 456 spoolsv.exe 152 PID 4672 set thread context of 1704 4672 spoolsv.exe 153 PID 3276 set thread context of 4280 3276 spoolsv.exe 154 PID 2080 set thread context of 5372 2080 spoolsv.exe 155 PID 4144 set thread context of 5540 4144 spoolsv.exe 156 PID 744 set thread context of 5768 744 spoolsv.exe 158 PID 3184 set thread context of 4984 3184 spoolsv.exe 159 PID 1048 set thread context of 1776 1048 spoolsv.exe 161 PID 4216 set thread context of 1528 4216 spoolsv.exe 162 PID 3108 set thread context of 6072 3108 spoolsv.exe 163 PID 4520 set thread context of 1768 4520 spoolsv.exe 165 PID 5016 set thread context of 5940 5016 spoolsv.exe 164 PID 3856 set thread context of 4924 3856 spoolsv.exe 166 PID 2296 set thread context of 5228 2296 spoolsv.exe 168 PID 4976 set thread context of 5236 4976 spoolsv.exe 169 PID 388 set thread context of 5424 388 spoolsv.exe 170 PID 3864 set thread context of 3628 3864 spoolsv.exe 172 PID 3180 set thread context of 4764 3180 spoolsv.exe 173 PID 6068 set thread context of 2444 6068 spoolsv.exe 174 PID 5192 set thread context of 1596 5192 spoolsv.exe 175 PID 5544 set thread context of 3832 5544 spoolsv.exe 177 PID 1220 set thread context of 2472 1220 spoolsv.exe 176 PID 5844 set thread context of 3460 5844 spoolsv.exe 178 PID 340 set thread context of 1308 340 spoolsv.exe 179 PID 5452 set thread context of 2904 5452 spoolsv.exe 180 PID 5828 set thread context of 2316 5828 spoolsv.exe 181 PID 5140 set thread context of 3964 5140 spoolsv.exe 182 PID 2244 set thread context of 3332 2244 spoolsv.exe 183 PID 5584 set thread context of 1468 5584 spoolsv.exe 184 PID 5168 set thread context of 5176 5168 spoolsv.exe 186 PID 5380 set thread context of 3672 5380 spoolsv.exe 187 PID 5440 set thread context of 1212 5440 spoolsv.exe 222 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4868 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 5320 spoolsv.exe 5320 spoolsv.exe 5680 spoolsv.exe 5680 spoolsv.exe 6008 spoolsv.exe 6008 spoolsv.exe 6104 spoolsv.exe 6104 spoolsv.exe 1704 spoolsv.exe 1704 spoolsv.exe 4280 spoolsv.exe 4280 spoolsv.exe 5372 spoolsv.exe 5372 spoolsv.exe 5540 spoolsv.exe 5540 spoolsv.exe 5768 spoolsv.exe 5768 spoolsv.exe 4984 spoolsv.exe 4984 spoolsv.exe 1776 spoolsv.exe 1776 spoolsv.exe 1528 spoolsv.exe 1528 spoolsv.exe 6072 spoolsv.exe 6072 spoolsv.exe 1768 spoolsv.exe 1768 spoolsv.exe 5940 spoolsv.exe 4924 spoolsv.exe 5940 spoolsv.exe 4924 spoolsv.exe 5228 spoolsv.exe 5236 spoolsv.exe 5228 spoolsv.exe 5236 spoolsv.exe 5424 spoolsv.exe 3628 spoolsv.exe 5424 spoolsv.exe 3628 spoolsv.exe 4764 spoolsv.exe 2444 spoolsv.exe 4764 spoolsv.exe 2444 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 3832 spoolsv.exe 2472 spoolsv.exe 3832 spoolsv.exe 3460 spoolsv.exe 2472 spoolsv.exe 3460 spoolsv.exe 1308 spoolsv.exe 2904 spoolsv.exe 1308 spoolsv.exe 2904 spoolsv.exe 2316 spoolsv.exe 2316 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2016 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 87 PID 1612 wrote to memory of 2016 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 87 PID 1612 wrote to memory of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 1612 wrote to memory of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 1612 wrote to memory of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 1612 wrote to memory of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 1612 wrote to memory of 772 1612 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 102 PID 772 wrote to memory of 3108 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 103 PID 772 wrote to memory of 3108 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 103 PID 772 wrote to memory of 3108 772 0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe 103 PID 3108 wrote to memory of 4868 3108 explorer.exe 107 PID 3108 wrote to memory of 4868 3108 explorer.exe 107 PID 3108 wrote to memory of 4868 3108 explorer.exe 107 PID 3108 wrote to memory of 4868 3108 explorer.exe 107 PID 3108 wrote to memory of 4868 3108 explorer.exe 107 PID 4868 wrote to memory of 60 4868 explorer.exe 108 PID 4868 wrote to memory of 60 4868 explorer.exe 108 PID 4868 wrote to memory of 60 4868 explorer.exe 108 PID 4868 wrote to memory of 344 4868 explorer.exe 109 PID 4868 wrote to memory of 344 4868 explorer.exe 109 PID 4868 wrote to memory of 344 4868 explorer.exe 109 PID 4868 wrote to memory of 1576 4868 explorer.exe 110 PID 4868 wrote to memory of 1576 4868 explorer.exe 110 PID 4868 wrote to memory of 1576 4868 explorer.exe 110 PID 4868 wrote to memory of 456 4868 explorer.exe 111 PID 4868 wrote to memory of 456 4868 explorer.exe 111 PID 4868 wrote to memory of 456 4868 explorer.exe 111 PID 4868 wrote to memory of 4672 4868 explorer.exe 112 PID 4868 wrote to memory of 4672 4868 explorer.exe 112 PID 4868 wrote to memory of 4672 4868 explorer.exe 112 PID 4868 wrote to memory of 3276 4868 explorer.exe 113 PID 4868 wrote to memory of 3276 4868 explorer.exe 113 PID 4868 wrote to memory of 3276 4868 explorer.exe 113 PID 4868 wrote to memory of 2080 4868 explorer.exe 114 PID 4868 wrote to memory of 2080 4868 explorer.exe 114 PID 4868 wrote to memory of 2080 4868 explorer.exe 114 PID 4868 wrote to memory of 4144 4868 explorer.exe 115 PID 4868 wrote to memory of 4144 4868 explorer.exe 115 PID 4868 wrote to memory of 4144 4868 explorer.exe 115 PID 4868 wrote to memory of 744 4868 explorer.exe 116 PID 4868 wrote to memory of 744 4868 explorer.exe 116 PID 4868 wrote to memory of 744 4868 explorer.exe 116 PID 4868 wrote to memory of 3184 4868 explorer.exe 117 PID 4868 wrote to memory of 3184 4868 explorer.exe 117 PID 4868 wrote to memory of 3184 4868 explorer.exe 117 PID 4868 wrote to memory of 1048 4868 explorer.exe 118 PID 4868 wrote to memory of 1048 4868 explorer.exe 118 PID 4868 wrote to memory of 1048 4868 explorer.exe 118 PID 4868 wrote to memory of 4216 4868 explorer.exe 120 PID 4868 wrote to memory of 4216 4868 explorer.exe 120 PID 4868 wrote to memory of 4216 4868 explorer.exe 120 PID 4868 wrote to memory of 3108 4868 explorer.exe 121 PID 4868 wrote to memory of 3108 4868 explorer.exe 121 PID 4868 wrote to memory of 3108 4868 explorer.exe 121 PID 4868 wrote to memory of 5016 4868 explorer.exe 123 PID 4868 wrote to memory of 5016 4868 explorer.exe 123 PID 4868 wrote to memory of 5016 4868 explorer.exe 123 PID 4868 wrote to memory of 4520 4868 explorer.exe 124 PID 4868 wrote to memory of 4520 4868 explorer.exe 124 PID 4868 wrote to memory of 4520 4868 explorer.exe 124 PID 4868 wrote to memory of 3856 4868 explorer.exe 125 PID 4868 wrote to memory of 3856 4868 explorer.exe 125 PID 4868 wrote to memory of 3856 4868 explorer.exe 125 PID 4868 wrote to memory of 2296 4868 explorer.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0014cb2974a8f2ea528843b3310e0a69_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5320 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5668 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5592
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5680
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5372
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:4496 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5600
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1212
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:6088
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4844
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5348
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6136
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6052
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1936
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6092
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4512
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3312
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5792
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2280
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5bfcd728aaf7320a33ce760df66db4205
SHA1a3a9f90027a4c299d464d242bb1d2b389c55d444
SHA2565c12c72a92923364bbefd39613f8d7bfa6608e290bea99b42e09b9440912d525
SHA51247db9a045e274cd5cba1bde97c756d637dbf912f7e0bdf2c08e166f7190e632fe1657e71388f29387c99132765fa12c0ec62825ad9edc2108426f97c2ec3a9b4
-
Filesize
2.2MB
MD51d619016be2eee2411e8d54e6ce43b87
SHA114e19d949df46cb97e2692429de1712308dce6be
SHA25680c043c3b1a7fa192f1fcd28051ea1252540f931fbc2e5735e8a924f6f3eb1e7
SHA5127eac032534da640336a2758b8d11d6ef05681c8a9577e79f8c60c0a96dfa708786d74326cd05fee195db1b68f65a68eeb9ede1df2afedd13b75462b4bad1b50f