Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 14:50
Behavioral task
behavioral1
Sample
0103275a10980d859c299548ec98949d_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0103275a10980d859c299548ec98949d_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0103275a10980d859c299548ec98949d
-
SHA1
54fa181aa24667da526f76447c99f3c5d94cea7e
-
SHA256
389e8e0352e05a3287fdd12c176dbd1d1b24f67f8b7d2b7b13fa5e8b2cb38962
-
SHA512
a4420f0b539ccd5fbc36c38f953e7fea620a55b8e758f2980cfa26231b2ea2566d2c18b3f3711f3a378621227937ea16669ef95817df7284b200dfe4cd5f144e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZa:0UzeyQMS4DqodCnoe+iitjWwwG
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0103275a10980d859c299548ec98949d_JaffaCakes118.exe 0103275a10980d859c299548ec98949d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0103275a10980d859c299548ec98949d_JaffaCakes118.exe 0103275a10980d859c299548ec98949d_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1292 explorer.exe 4020 explorer.exe 4648 spoolsv.exe 388 spoolsv.exe 3004 spoolsv.exe 404 spoolsv.exe 2188 spoolsv.exe 3116 spoolsv.exe 1468 spoolsv.exe 4004 spoolsv.exe 2520 spoolsv.exe 3604 spoolsv.exe 3152 spoolsv.exe 3216 spoolsv.exe 2776 spoolsv.exe 3112 spoolsv.exe 1540 spoolsv.exe 624 spoolsv.exe 4072 spoolsv.exe 2840 spoolsv.exe 3468 spoolsv.exe 4304 spoolsv.exe 2928 spoolsv.exe 3740 spoolsv.exe 4384 spoolsv.exe 1036 spoolsv.exe 3316 spoolsv.exe 1956 spoolsv.exe 2212 spoolsv.exe 1536 spoolsv.exe 1068 spoolsv.exe 520 spoolsv.exe 5204 spoolsv.exe 5484 spoolsv.exe 5756 spoolsv.exe 6040 spoolsv.exe 1388 spoolsv.exe 5128 explorer.exe 5196 spoolsv.exe 5292 spoolsv.exe 5360 spoolsv.exe 5456 spoolsv.exe 5752 spoolsv.exe 5864 spoolsv.exe 3400 spoolsv.exe 5284 spoolsv.exe 5380 explorer.exe 5432 spoolsv.exe 5544 spoolsv.exe 5160 spoolsv.exe 5180 explorer.exe 2208 spoolsv.exe 4632 spoolsv.exe 5024 spoolsv.exe 4724 spoolsv.exe 5476 spoolsv.exe 5648 spoolsv.exe 5520 spoolsv.exe 5688 spoolsv.exe 4944 spoolsv.exe 5228 spoolsv.exe 3080 explorer.exe 1316 spoolsv.exe 2248 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 3912 set thread context of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 1292 set thread context of 4020 1292 explorer.exe 106 PID 4648 set thread context of 1388 4648 spoolsv.exe 146 PID 388 set thread context of 5196 388 spoolsv.exe 148 PID 3004 set thread context of 5292 3004 spoolsv.exe 149 PID 404 set thread context of 5360 404 spoolsv.exe 150 PID 2188 set thread context of 5456 2188 spoolsv.exe 151 PID 3116 set thread context of 5864 3116 spoolsv.exe 153 PID 1468 set thread context of 5284 1468 spoolsv.exe 155 PID 4004 set thread context of 5432 4004 spoolsv.exe 157 PID 2520 set thread context of 5160 2520 spoolsv.exe 159 PID 3604 set thread context of 2208 3604 spoolsv.exe 161 PID 3152 set thread context of 4632 3152 spoolsv.exe 162 PID 3216 set thread context of 5024 3216 spoolsv.exe 163 PID 2776 set thread context of 4724 2776 spoolsv.exe 164 PID 3112 set thread context of 5476 3112 spoolsv.exe 165 PID 1540 set thread context of 5648 1540 spoolsv.exe 166 PID 624 set thread context of 5520 624 spoolsv.exe 167 PID 4072 set thread context of 5688 4072 spoolsv.exe 168 PID 2840 set thread context of 5228 2840 spoolsv.exe 170 PID 3468 set thread context of 1316 3468 spoolsv.exe 172 PID 4304 set thread context of 2248 4304 spoolsv.exe 173 PID 2928 set thread context of 4404 2928 spoolsv.exe 174 PID 3740 set thread context of 3588 3740 spoolsv.exe 175 PID 4384 set thread context of 2396 4384 spoolsv.exe 176 PID 1036 set thread context of 3220 1036 spoolsv.exe 177 PID 3316 set thread context of 4976 3316 spoolsv.exe 178 PID 1956 set thread context of 5876 1956 spoolsv.exe 180 PID 2212 set thread context of 636 2212 spoolsv.exe 182 PID 1536 set thread context of 3500 1536 spoolsv.exe 184 PID 1068 set thread context of 4204 1068 spoolsv.exe 185 PID 520 set thread context of 3284 520 spoolsv.exe 186 PID 5204 set thread context of 4172 5204 spoolsv.exe 187 PID 5484 set thread context of 4056 5484 spoolsv.exe 188 PID 5756 set thread context of 5420 5756 spoolsv.exe 190 PID 6040 set thread context of 5240 6040 spoolsv.exe 201 PID 5752 set thread context of 5052 5752 spoolsv.exe 203 PID 5128 set thread context of 3028 5128 explorer.exe 204 PID 3400 set thread context of 1704 3400 spoolsv.exe 207 PID 5380 set thread context of 4108 5380 explorer.exe 209 PID 5544 set thread context of 4948 5544 spoolsv.exe 220 PID 5180 set thread context of 1628 5180 explorer.exe 222 PID 4944 set thread context of 6132 4944 spoolsv.exe 227 PID 3080 set thread context of 4592 3080 explorer.exe 230 PID 5996 set thread context of 3876 5996 spoolsv.exe 233 PID 1616 set thread context of 5460 1616 explorer.exe 235 PID 392 set thread context of 5596 392 spoolsv.exe 236 PID 5624 set thread context of 5556 5624 explorer.exe 237 PID 1652 set thread context of 448 1652 spoolsv.exe 238 PID 5580 set thread context of 760 5580 spoolsv.exe 239 PID 5672 set thread context of 5168 5672 spoolsv.exe 240 PID 5776 set thread context of 4516 5776 spoolsv.exe 241 PID 5280 set thread context of 1836 5280 spoolsv.exe 243 PID 3012 set thread context of 5192 3012 spoolsv.exe 244 PID 2168 set thread context of 4520 2168 explorer.exe 245 PID 5532 set thread context of 3904 5532 spoolsv.exe 246 PID 2768 set thread context of 4852 2768 spoolsv.exe 248 PID 1452 set thread context of 4524 1452 explorer.exe 250 PID 5692 set thread context of 1404 5692 spoolsv.exe 251 PID 2220 set thread context of 2284 2220 spoolsv.exe 252 PID 2788 set thread context of 6080 2788 spoolsv.exe 253 PID 1804 set thread context of 2264 1804 spoolsv.exe 255 PID 3508 set thread context of 5112 3508 spoolsv.exe 256 PID 536 set thread context of 4604 536 spoolsv.exe 259 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 0103275a10980d859c299548ec98949d_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4020 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 4020 explorer.exe 1388 spoolsv.exe 1388 spoolsv.exe 5196 spoolsv.exe 5196 spoolsv.exe 5292 spoolsv.exe 5292 spoolsv.exe 5360 spoolsv.exe 5360 spoolsv.exe 5456 spoolsv.exe 5456 spoolsv.exe 5864 spoolsv.exe 5864 spoolsv.exe 5284 spoolsv.exe 5284 spoolsv.exe 5432 spoolsv.exe 5432 spoolsv.exe 5160 spoolsv.exe 5160 spoolsv.exe 2208 spoolsv.exe 2208 spoolsv.exe 4632 spoolsv.exe 4632 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 4724 spoolsv.exe 4724 spoolsv.exe 5476 spoolsv.exe 5476 spoolsv.exe 5648 spoolsv.exe 5648 spoolsv.exe 5520 spoolsv.exe 5520 spoolsv.exe 5688 spoolsv.exe 5688 spoolsv.exe 5228 spoolsv.exe 5228 spoolsv.exe 1316 spoolsv.exe 1316 spoolsv.exe 2248 spoolsv.exe 2248 spoolsv.exe 4404 spoolsv.exe 4404 spoolsv.exe 3588 spoolsv.exe 3588 spoolsv.exe 2396 spoolsv.exe 2396 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 4976 spoolsv.exe 4976 spoolsv.exe 5876 spoolsv.exe 5876 spoolsv.exe 636 spoolsv.exe 636 spoolsv.exe 3500 spoolsv.exe 3500 spoolsv.exe 4204 spoolsv.exe 4204 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3912 wrote to memory of 1376 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 85 PID 3912 wrote to memory of 1376 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 85 PID 3912 wrote to memory of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 3912 wrote to memory of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 3912 wrote to memory of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 3912 wrote to memory of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 3912 wrote to memory of 4876 3912 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 102 PID 4876 wrote to memory of 1292 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 103 PID 4876 wrote to memory of 1292 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 103 PID 4876 wrote to memory of 1292 4876 0103275a10980d859c299548ec98949d_JaffaCakes118.exe 103 PID 1292 wrote to memory of 4020 1292 explorer.exe 106 PID 1292 wrote to memory of 4020 1292 explorer.exe 106 PID 1292 wrote to memory of 4020 1292 explorer.exe 106 PID 1292 wrote to memory of 4020 1292 explorer.exe 106 PID 1292 wrote to memory of 4020 1292 explorer.exe 106 PID 4020 wrote to memory of 4648 4020 explorer.exe 107 PID 4020 wrote to memory of 4648 4020 explorer.exe 107 PID 4020 wrote to memory of 4648 4020 explorer.exe 107 PID 4020 wrote to memory of 388 4020 explorer.exe 108 PID 4020 wrote to memory of 388 4020 explorer.exe 108 PID 4020 wrote to memory of 388 4020 explorer.exe 108 PID 4020 wrote to memory of 3004 4020 explorer.exe 109 PID 4020 wrote to memory of 3004 4020 explorer.exe 109 PID 4020 wrote to memory of 3004 4020 explorer.exe 109 PID 4020 wrote to memory of 404 4020 explorer.exe 110 PID 4020 wrote to memory of 404 4020 explorer.exe 110 PID 4020 wrote to memory of 404 4020 explorer.exe 110 PID 4020 wrote to memory of 2188 4020 explorer.exe 111 PID 4020 wrote to memory of 2188 4020 explorer.exe 111 PID 4020 wrote to memory of 2188 4020 explorer.exe 111 PID 4020 wrote to memory of 3116 4020 explorer.exe 112 PID 4020 wrote to memory of 3116 4020 explorer.exe 112 PID 4020 wrote to memory of 3116 4020 explorer.exe 112 PID 4020 wrote to memory of 1468 4020 explorer.exe 113 PID 4020 wrote to memory of 1468 4020 explorer.exe 113 PID 4020 wrote to memory of 1468 4020 explorer.exe 113 PID 4020 wrote to memory of 4004 4020 explorer.exe 114 PID 4020 wrote to memory of 4004 4020 explorer.exe 114 PID 4020 wrote to memory of 4004 4020 explorer.exe 114 PID 4020 wrote to memory of 2520 4020 explorer.exe 115 PID 4020 wrote to memory of 2520 4020 explorer.exe 115 PID 4020 wrote to memory of 2520 4020 explorer.exe 115 PID 4020 wrote to memory of 3604 4020 explorer.exe 116 PID 4020 wrote to memory of 3604 4020 explorer.exe 116 PID 4020 wrote to memory of 3604 4020 explorer.exe 116 PID 4020 wrote to memory of 3152 4020 explorer.exe 117 PID 4020 wrote to memory of 3152 4020 explorer.exe 117 PID 4020 wrote to memory of 3152 4020 explorer.exe 117 PID 4020 wrote to memory of 3216 4020 explorer.exe 118 PID 4020 wrote to memory of 3216 4020 explorer.exe 118 PID 4020 wrote to memory of 3216 4020 explorer.exe 118 PID 4020 wrote to memory of 2776 4020 explorer.exe 119 PID 4020 wrote to memory of 2776 4020 explorer.exe 119 PID 4020 wrote to memory of 2776 4020 explorer.exe 119 PID 4020 wrote to memory of 3112 4020 explorer.exe 120 PID 4020 wrote to memory of 3112 4020 explorer.exe 120 PID 4020 wrote to memory of 3112 4020 explorer.exe 120 PID 4020 wrote to memory of 1540 4020 explorer.exe 121 PID 4020 wrote to memory of 1540 4020 explorer.exe 121 PID 4020 wrote to memory of 1540 4020 explorer.exe 121 PID 4020 wrote to memory of 624 4020 explorer.exe 122 PID 4020 wrote to memory of 624 4020 explorer.exe 122 PID 4020 wrote to memory of 624 4020 explorer.exe 122 PID 4020 wrote to memory of 4072 4020 explorer.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\0103275a10980d859c299548ec98949d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0103275a10980d859c299548ec98949d_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1376
-
-
C:\Users\Admin\AppData\Local\Temp\0103275a10980d859c299548ec98949d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0103275a10980d859c299548ec98949d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1388 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5128 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3028
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5196
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5360
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2188 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5864
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5284 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5380 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4108
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5432
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5160 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5180 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2208
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5228 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3080 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4592
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3588
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5876
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:636 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1616 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5460
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4172
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5420
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5624 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5556
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5240
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2168 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4520
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5052
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1704
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4524
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4948
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5908
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6132
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4652
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:5996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3876
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:676
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5596
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5168
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:5280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4852
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3396
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2264
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3176
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4604
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5640
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6120
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5596
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5912
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5576
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5256
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:632
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1144
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD53b37823833cdebeeeccd048c5b9df1bd
SHA19ee1ee61c4546b6b3d6602267853c8c00594a63c
SHA2561dd98b10b95ef8f22a15f603b1bb93304b2e4034016570f6901ee5a8417810e2
SHA512c7d53e11a48b1fbf39923d9a1abbadcbdd01c13f3d8b4c960f5c1c9a10ceef8b7667b543b3e7b326bc15a20d8b38bebc39b9d2f72224e87fd8486f59612f0644
-
Filesize
2.2MB
MD5b468fbbe5c9606e325ebdf3773ecd8f5
SHA1254bc7bd5cdcf18f28c1a900af95375f5e93db6b
SHA2560d0daa3b84749951b3bc1cdaeca734513d878b20409dad4f07fcb266b5935adb
SHA5127236dce11a90be4755c1e52039f9b49a0bf0900109db3157f156e16d6fbbd374fa71459dbda62d4a05378e4b69776119f02ae2abe1574f9a5c8852d2af500be9