Analysis
-
max time kernel
145s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 11:14
Behavioral task
behavioral1
Sample
00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
00a41ae28e49bb972c531c47c0365206
-
SHA1
690d2267ea9a6462c9a9a9aea5d922b9d23b00c7
-
SHA256
47c4212040b0c2e9bb3d2fe7e2471e91c05cf3044daaa4efe6769102f440129c
-
SHA512
367e0c442ddc19c46441215c865144de69b397e240f793d3625bdd93c5e78bdb199a63e4f6040760864b73c2741af91c34dc7005a567b321b8b026d409f52001
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZT:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1276 explorer.exe 1312 explorer.exe 1672 spoolsv.exe 1864 spoolsv.exe 3396 spoolsv.exe 3444 spoolsv.exe 2096 spoolsv.exe 3280 spoolsv.exe 2880 spoolsv.exe 1344 spoolsv.exe 2704 spoolsv.exe 2628 spoolsv.exe 2676 spoolsv.exe 2248 spoolsv.exe 2596 spoolsv.exe 3848 spoolsv.exe 4540 spoolsv.exe 4388 spoolsv.exe 920 spoolsv.exe 1216 spoolsv.exe 1220 spoolsv.exe 4644 spoolsv.exe 2536 spoolsv.exe 1072 spoolsv.exe 636 spoolsv.exe 2812 spoolsv.exe 4792 spoolsv.exe 3284 spoolsv.exe 4860 spoolsv.exe 1276 spoolsv.exe 1496 spoolsv.exe 3940 spoolsv.exe 3712 spoolsv.exe 2660 explorer.exe 1892 spoolsv.exe 1332 spoolsv.exe 4632 spoolsv.exe 2308 spoolsv.exe 5036 spoolsv.exe 3124 spoolsv.exe 1064 spoolsv.exe 3504 explorer.exe 4528 spoolsv.exe 3632 spoolsv.exe 4608 spoolsv.exe 900 spoolsv.exe 1192 spoolsv.exe 2500 explorer.exe 3400 spoolsv.exe 1888 spoolsv.exe 3680 spoolsv.exe 1920 spoolsv.exe 3244 spoolsv.exe 4680 explorer.exe 4064 spoolsv.exe 4060 spoolsv.exe 3332 spoolsv.exe 1900 spoolsv.exe 4176 spoolsv.exe 1112 explorer.exe 4220 spoolsv.exe 4392 spoolsv.exe 2020 spoolsv.exe 2976 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
description pid Process procid_target PID 4644 set thread context of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 1276 set thread context of 1312 1276 explorer.exe 91 PID 1672 set thread context of 3712 1672 spoolsv.exe 124 PID 1864 set thread context of 1892 1864 spoolsv.exe 126 PID 3396 set thread context of 1332 3396 spoolsv.exe 127 PID 3444 set thread context of 4632 3444 spoolsv.exe 128 PID 2096 set thread context of 2308 2096 spoolsv.exe 129 PID 3280 set thread context of 3124 3280 spoolsv.exe 131 PID 2880 set thread context of 1064 2880 spoolsv.exe 132 PID 1344 set thread context of 4528 1344 spoolsv.exe 134 PID 2704 set thread context of 3632 2704 spoolsv.exe 135 PID 2628 set thread context of 4608 2628 spoolsv.exe 136 PID 2676 set thread context of 1192 2676 spoolsv.exe 138 PID 2248 set thread context of 3400 2248 spoolsv.exe 140 PID 2596 set thread context of 1888 2596 spoolsv.exe 141 PID 3848 set thread context of 1920 3848 spoolsv.exe 143 PID 4540 set thread context of 3244 4540 spoolsv.exe 144 PID 4388 set thread context of 4064 4388 spoolsv.exe 146 PID 920 set thread context of 4060 920 spoolsv.exe 147 PID 1216 set thread context of 3332 1216 spoolsv.exe 148 PID 1220 set thread context of 4176 1220 spoolsv.exe 150 PID 4644 set thread context of 4220 4644 spoolsv.exe 152 PID 2536 set thread context of 4392 2536 spoolsv.exe 153 PID 1072 set thread context of 2976 1072 spoolsv.exe 155 PID 636 set thread context of 3704 636 spoolsv.exe 156 PID 2812 set thread context of 3256 2812 spoolsv.exe 158 PID 4792 set thread context of 3240 4792 spoolsv.exe 159 PID 3284 set thread context of 1164 3284 spoolsv.exe 160 PID 4860 set thread context of 1988 4860 spoolsv.exe 162 PID 1276 set thread context of 3972 1276 spoolsv.exe 164 PID 1496 set thread context of 4064 1496 spoolsv.exe 166 PID 3940 set thread context of 3264 3940 spoolsv.exe 170 PID 2660 set thread context of 4912 2660 explorer.exe 172 PID 5036 set thread context of 4692 5036 spoolsv.exe 176 PID 3504 set thread context of 2380 3504 explorer.exe 178 PID 900 set thread context of 4260 900 spoolsv.exe 181 PID 2500 set thread context of 924 2500 explorer.exe 183 PID 3680 set thread context of 4436 3680 spoolsv.exe 186 PID 4680 set thread context of 2408 4680 explorer.exe 188 PID 1900 set thread context of 3388 1900 spoolsv.exe 191 PID 1112 set thread context of 692 1112 explorer.exe 193 PID 2020 set thread context of 392 2020 spoolsv.exe 197 PID 3564 set thread context of 1140 3564 explorer.exe 199 PID 4776 set thread context of 3432 4776 spoolsv.exe 202 PID 1056 set thread context of 1692 1056 explorer.exe 204 PID 4676 set thread context of 1916 4676 spoolsv.exe 205 PID 3708 set thread context of 4476 3708 spoolsv.exe 206 PID 4864 set thread context of 1048 4864 spoolsv.exe 208 PID 4568 set thread context of 4600 4568 spoolsv.exe 211 PID 888 set thread context of 1324 888 explorer.exe 213 PID 4068 set thread context of 4132 4068 spoolsv.exe 215 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 1312 explorer.exe 3712 spoolsv.exe 3712 spoolsv.exe 1892 spoolsv.exe 1892 spoolsv.exe 1332 spoolsv.exe 1332 spoolsv.exe 4632 spoolsv.exe 4632 spoolsv.exe 2308 spoolsv.exe 2308 spoolsv.exe 3124 spoolsv.exe 3124 spoolsv.exe 1064 spoolsv.exe 1064 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 3632 spoolsv.exe 3632 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 3400 spoolsv.exe 3400 spoolsv.exe 1888 spoolsv.exe 1888 spoolsv.exe 1920 spoolsv.exe 1920 spoolsv.exe 3244 spoolsv.exe 3244 spoolsv.exe 4060 spoolsv.exe 4060 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 4176 spoolsv.exe 4176 spoolsv.exe 4220 spoolsv.exe 4220 spoolsv.exe 4392 spoolsv.exe 4392 spoolsv.exe 2976 spoolsv.exe 2976 spoolsv.exe 3704 spoolsv.exe 3704 spoolsv.exe 3256 spoolsv.exe 3256 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 1164 spoolsv.exe 1164 spoolsv.exe 1988 spoolsv.exe 1988 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 3264 spoolsv.exe 3264 spoolsv.exe 4912 explorer.exe 4912 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 428 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 82 PID 4644 wrote to memory of 428 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 82 PID 4644 wrote to memory of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 4644 wrote to memory of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 4644 wrote to memory of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 4644 wrote to memory of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 4644 wrote to memory of 1408 4644 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 87 PID 1408 wrote to memory of 1276 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 88 PID 1408 wrote to memory of 1276 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 88 PID 1408 wrote to memory of 1276 1408 00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe 88 PID 1276 wrote to memory of 1312 1276 explorer.exe 91 PID 1276 wrote to memory of 1312 1276 explorer.exe 91 PID 1276 wrote to memory of 1312 1276 explorer.exe 91 PID 1276 wrote to memory of 1312 1276 explorer.exe 91 PID 1276 wrote to memory of 1312 1276 explorer.exe 91 PID 1312 wrote to memory of 1672 1312 explorer.exe 92 PID 1312 wrote to memory of 1672 1312 explorer.exe 92 PID 1312 wrote to memory of 1672 1312 explorer.exe 92 PID 1312 wrote to memory of 1864 1312 explorer.exe 93 PID 1312 wrote to memory of 1864 1312 explorer.exe 93 PID 1312 wrote to memory of 1864 1312 explorer.exe 93 PID 1312 wrote to memory of 3396 1312 explorer.exe 94 PID 1312 wrote to memory of 3396 1312 explorer.exe 94 PID 1312 wrote to memory of 3396 1312 explorer.exe 94 PID 1312 wrote to memory of 3444 1312 explorer.exe 95 PID 1312 wrote to memory of 3444 1312 explorer.exe 95 PID 1312 wrote to memory of 3444 1312 explorer.exe 95 PID 1312 wrote to memory of 2096 1312 explorer.exe 96 PID 1312 wrote to memory of 2096 1312 explorer.exe 96 PID 1312 wrote to memory of 2096 1312 explorer.exe 96 PID 1312 wrote to memory of 3280 1312 explorer.exe 97 PID 1312 wrote to memory of 3280 1312 explorer.exe 97 PID 1312 wrote to memory of 3280 1312 explorer.exe 97 PID 1312 wrote to memory of 2880 1312 explorer.exe 98 PID 1312 wrote to memory of 2880 1312 explorer.exe 98 PID 1312 wrote to memory of 2880 1312 explorer.exe 98 PID 1312 wrote to memory of 1344 1312 explorer.exe 99 PID 1312 wrote to memory of 1344 1312 explorer.exe 99 PID 1312 wrote to memory of 1344 1312 explorer.exe 99 PID 1312 wrote to memory of 2704 1312 explorer.exe 100 PID 1312 wrote to memory of 2704 1312 explorer.exe 100 PID 1312 wrote to memory of 2704 1312 explorer.exe 100 PID 1312 wrote to memory of 2628 1312 explorer.exe 101 PID 1312 wrote to memory of 2628 1312 explorer.exe 101 PID 1312 wrote to memory of 2628 1312 explorer.exe 101 PID 1312 wrote to memory of 2676 1312 explorer.exe 102 PID 1312 wrote to memory of 2676 1312 explorer.exe 102 PID 1312 wrote to memory of 2676 1312 explorer.exe 102 PID 1312 wrote to memory of 2248 1312 explorer.exe 105 PID 1312 wrote to memory of 2248 1312 explorer.exe 105 PID 1312 wrote to memory of 2248 1312 explorer.exe 105 PID 1312 wrote to memory of 2596 1312 explorer.exe 106 PID 1312 wrote to memory of 2596 1312 explorer.exe 106 PID 1312 wrote to memory of 2596 1312 explorer.exe 106 PID 1312 wrote to memory of 3848 1312 explorer.exe 107 PID 1312 wrote to memory of 3848 1312 explorer.exe 107 PID 1312 wrote to memory of 3848 1312 explorer.exe 107 PID 1312 wrote to memory of 4540 1312 explorer.exe 108 PID 1312 wrote to memory of 4540 1312 explorer.exe 108 PID 1312 wrote to memory of 4540 1312 explorer.exe 108 PID 1312 wrote to memory of 4388 1312 explorer.exe 109 PID 1312 wrote to memory of 4388 1312 explorer.exe 109 PID 1312 wrote to memory of 4388 1312 explorer.exe 109 PID 1312 wrote to memory of 920 1312 explorer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:428
-
-
C:\Users\Admin\AppData\Local\Temp\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00a41ae28e49bb972c531c47c0365206_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3712 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2660 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:4912
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2308
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2380
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2500 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:924
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3244 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4680 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2408
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
PID:4064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4176 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1112 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:692
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3704 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3564 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1140
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3240
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1692
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:888 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1324
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4884 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1796
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4260
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4400
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4436
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1436
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3388
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:872
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:392
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1416
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3432
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4896
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1048
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2948
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4600
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4132
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2744
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2200
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3804
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4808
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2192
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2292
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3636
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2196
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4004
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD599bd23d161bf89c69280ded734d38703
SHA1608c4a0d3548c5d7d8214b6bf15c6e4afccecf08
SHA25658cbf54ad48e66c7b47082f937971d11d24cba163fa779ed1010120cedc7d3b5
SHA5122a4f39fbada2a14185251e69c836511f8217d4bf3bd40d704bdd883b92b913bf668de25f0d4cf4c6297c879e445d0cb499bb199cf2e35ef23ce9a773dd5c523e
-
Filesize
2.2MB
MD5a2229bb588a0eea16a414180f5bd6c61
SHA1d5972ada1d70814854fe8b0f8948c19745e76d69
SHA256ac97a322409610b921a7dccd1fa5a7dbb1f55eb0740467eec165390f0d47c5d6
SHA512f83767a6a8d6016b987fd0fa7352e9d4eebee09f5f9622395fbca3b4a837512e50daba91432aed569fc63f4d0768c2097eaa867caae1a275f57b167aa7650f8b