Analysis
-
max time kernel
80s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 10:06
Behavioral task
behavioral1
Sample
0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0087547aae70834f43fdcaa2ae045bb8
-
SHA1
c3b1434ea67b2b9d73901ee27e5cdc5a21d0a459
-
SHA256
ae0935dbf1765ffb99b706d9adc0f2908501456f476b6de51fec671d5e4b9066
-
SHA512
7da639b03bfa11987123f2bbe6ce5c4cb8b15a5ccefcf1a5d06a4b3e33425dacf3d48b84a90301921333a7768d79c3d09a5652c6610b6a8771e6a86f5d9b0e6a
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwG
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe -
Executes dropped EXE 47 IoCs
pid Process 2812 explorer.exe 3916 explorer.exe 3452 spoolsv.exe 1064 spoolsv.exe 1836 spoolsv.exe 3520 spoolsv.exe 5052 spoolsv.exe 5116 spoolsv.exe 1560 spoolsv.exe 2244 spoolsv.exe 4632 spoolsv.exe 1048 spoolsv.exe 3556 spoolsv.exe 2812 spoolsv.exe 3528 spoolsv.exe 4360 spoolsv.exe 1460 spoolsv.exe 4160 spoolsv.exe 3996 spoolsv.exe 1056 spoolsv.exe 4624 spoolsv.exe 772 spoolsv.exe 5316 spoolsv.exe 5644 spoolsv.exe 5880 spoolsv.exe 5184 spoolsv.exe 5560 spoolsv.exe 6040 spoolsv.exe 5396 spoolsv.exe 5768 spoolsv.exe 6128 spoolsv.exe 5600 spoolsv.exe 5976 spoolsv.exe 5312 spoolsv.exe 5908 spoolsv.exe 5608 spoolsv.exe 4444 spoolsv.exe 6088 spoolsv.exe 1544 spoolsv.exe 5864 spoolsv.exe 5720 spoolsv.exe 5496 spoolsv.exe 5260 spoolsv.exe 5208 spoolsv.exe 4040 spoolsv.exe 5784 spoolsv.exe 5144 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1408 set thread context of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 2812 set thread context of 3916 2812 explorer.exe 108 -
Drops file in Windows directory 49 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe 3916 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1916 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 86 PID 1408 wrote to memory of 1916 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 86 PID 1408 wrote to memory of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 1408 wrote to memory of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 1408 wrote to memory of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 1408 wrote to memory of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 1408 wrote to memory of 2008 1408 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 103 PID 2008 wrote to memory of 2812 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 104 PID 2008 wrote to memory of 2812 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 104 PID 2008 wrote to memory of 2812 2008 0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe 104 PID 2812 wrote to memory of 3916 2812 explorer.exe 108 PID 2812 wrote to memory of 3916 2812 explorer.exe 108 PID 2812 wrote to memory of 3916 2812 explorer.exe 108 PID 2812 wrote to memory of 3916 2812 explorer.exe 108 PID 2812 wrote to memory of 3916 2812 explorer.exe 108 PID 3916 wrote to memory of 3452 3916 explorer.exe 109 PID 3916 wrote to memory of 3452 3916 explorer.exe 109 PID 3916 wrote to memory of 3452 3916 explorer.exe 109 PID 3916 wrote to memory of 1064 3916 explorer.exe 110 PID 3916 wrote to memory of 1064 3916 explorer.exe 110 PID 3916 wrote to memory of 1064 3916 explorer.exe 110 PID 3916 wrote to memory of 1836 3916 explorer.exe 111 PID 3916 wrote to memory of 1836 3916 explorer.exe 111 PID 3916 wrote to memory of 1836 3916 explorer.exe 111 PID 3916 wrote to memory of 3520 3916 explorer.exe 112 PID 3916 wrote to memory of 3520 3916 explorer.exe 112 PID 3916 wrote to memory of 3520 3916 explorer.exe 112 PID 3916 wrote to memory of 5052 3916 explorer.exe 113 PID 3916 wrote to memory of 5052 3916 explorer.exe 113 PID 3916 wrote to memory of 5052 3916 explorer.exe 113 PID 3916 wrote to memory of 5116 3916 explorer.exe 114 PID 3916 wrote to memory of 5116 3916 explorer.exe 114 PID 3916 wrote to memory of 5116 3916 explorer.exe 114 PID 3916 wrote to memory of 1560 3916 explorer.exe 115 PID 3916 wrote to memory of 1560 3916 explorer.exe 115 PID 3916 wrote to memory of 1560 3916 explorer.exe 115 PID 3916 wrote to memory of 2244 3916 explorer.exe 116 PID 3916 wrote to memory of 2244 3916 explorer.exe 116 PID 3916 wrote to memory of 2244 3916 explorer.exe 116 PID 3916 wrote to memory of 4632 3916 explorer.exe 117 PID 3916 wrote to memory of 4632 3916 explorer.exe 117 PID 3916 wrote to memory of 4632 3916 explorer.exe 117 PID 3916 wrote to memory of 1048 3916 explorer.exe 118 PID 3916 wrote to memory of 1048 3916 explorer.exe 118 PID 3916 wrote to memory of 1048 3916 explorer.exe 118 PID 3916 wrote to memory of 3556 3916 explorer.exe 119 PID 3916 wrote to memory of 3556 3916 explorer.exe 119 PID 3916 wrote to memory of 3556 3916 explorer.exe 119 PID 3916 wrote to memory of 2812 3916 explorer.exe 120 PID 3916 wrote to memory of 2812 3916 explorer.exe 120 PID 3916 wrote to memory of 2812 3916 explorer.exe 120 PID 3916 wrote to memory of 3528 3916 explorer.exe 121 PID 3916 wrote to memory of 3528 3916 explorer.exe 121 PID 3916 wrote to memory of 3528 3916 explorer.exe 121 PID 3916 wrote to memory of 4360 3916 explorer.exe 122 PID 3916 wrote to memory of 4360 3916 explorer.exe 122 PID 3916 wrote to memory of 4360 3916 explorer.exe 122 PID 3916 wrote to memory of 1460 3916 explorer.exe 123 PID 3916 wrote to memory of 1460 3916 explorer.exe 123 PID 3916 wrote to memory of 1460 3916 explorer.exe 123 PID 3916 wrote to memory of 4160 3916 explorer.exe 124 PID 3916 wrote to memory of 4160 3916 explorer.exe 124 PID 3916 wrote to memory of 4160 3916 explorer.exe 124 PID 3916 wrote to memory of 3996 3916 explorer.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0087547aae70834f43fdcaa2ae045bb8_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:964
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5980
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5532
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5136
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2640
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1588
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3276
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4288
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5732
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5152
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:5144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3264
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5360
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4332
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6116
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4804
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6060
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6120
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:32
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2340
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2180
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3348
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5692
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4652
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD58d5de86d075c9c4ad4dbb5b75df70a3c
SHA1d4b4d39620b47cb47bac70acb4999500d71189f5
SHA2561fd03155f935cb0caf49b4559e10f026ca309673989206eefee6ee2247a94fe8
SHA512e79c3803e1766633f63723c8bbdb80bda1f250be75fbe8bf605d6d89d9b696d18db9bc388aaa65b9afc9a588100564ad721295a9e835c89be098688bf1bd697c
-
Filesize
2.2MB
MD5bae8b36fa648b6b2e0152e57fe38cd94
SHA1c6156de07366cf68d044b33cf03bd3b0ec72b903
SHA25672b3da59e4b6d5bf936b8ea8afd398a5a2d3982575d25f995f46e07f0744da78
SHA5120167a84cb065b763809c86bea966a7fa7454d1c0c2aa5ce7498e793b74b7a6de9ec6f9704153bb6cff5d134808e5dfcb4812f3fd6521e14a7d3f2b4f20825bc1