Analysis
-
max time kernel
148s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 14:15
Behavioral task
behavioral1
Sample
00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
00f38758786b84b1d6f9cf344fa44111
-
SHA1
c5f7e2c22740eec458e3053873bd7af6b9d30239
-
SHA256
54aac5062c30e4f8b9766c50d262147ec75d3093ca346cdd1bedf887ee65309c
-
SHA512
bd41163da53d73ca94a06fd455abd6e82814c526d79e5c5377da48e3b5ff72aa71fef3fc2da1691f6b9cc75f39b097ee977826eab732cb0b80f58cf03d33c5b3
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWww8
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4860 explorer.exe 3452 explorer.exe 1324 spoolsv.exe 4752 spoolsv.exe 5092 spoolsv.exe 4636 spoolsv.exe 4212 spoolsv.exe 3184 spoolsv.exe 60 spoolsv.exe 4124 spoolsv.exe 4836 spoolsv.exe 4356 spoolsv.exe 3872 spoolsv.exe 3112 spoolsv.exe 1476 spoolsv.exe 592 spoolsv.exe 2500 spoolsv.exe 4756 spoolsv.exe 640 spoolsv.exe 3396 spoolsv.exe 4536 spoolsv.exe 1340 spoolsv.exe 464 spoolsv.exe 4504 spoolsv.exe 4604 spoolsv.exe 2152 spoolsv.exe 3960 spoolsv.exe 2496 spoolsv.exe 1576 spoolsv.exe 3900 spoolsv.exe 1176 spoolsv.exe 4564 spoolsv.exe 3444 explorer.exe 4972 spoolsv.exe 4048 spoolsv.exe 4652 spoolsv.exe 2700 spoolsv.exe 1192 spoolsv.exe 920 explorer.exe 1212 spoolsv.exe 3148 spoolsv.exe 564 spoolsv.exe 4476 spoolsv.exe 4692 spoolsv.exe 216 spoolsv.exe 4628 explorer.exe 2128 spoolsv.exe 3752 spoolsv.exe 4688 spoolsv.exe 432 spoolsv.exe 3476 explorer.exe 1908 spoolsv.exe 4372 spoolsv.exe 4296 spoolsv.exe 1200 spoolsv.exe 4112 spoolsv.exe 872 explorer.exe 1896 spoolsv.exe 4432 spoolsv.exe 5096 spoolsv.exe 1348 spoolsv.exe 4240 spoolsv.exe 1896 explorer.exe 548 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
description pid Process procid_target PID 2564 set thread context of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 4860 set thread context of 3452 4860 explorer.exe 97 PID 1324 set thread context of 4564 1324 spoolsv.exe 129 PID 4752 set thread context of 4972 4752 spoolsv.exe 131 PID 5092 set thread context of 4048 5092 spoolsv.exe 132 PID 4636 set thread context of 4652 4636 spoolsv.exe 133 PID 4212 set thread context of 1192 4212 spoolsv.exe 135 PID 3184 set thread context of 1212 3184 spoolsv.exe 137 PID 60 set thread context of 3148 60 spoolsv.exe 138 PID 4124 set thread context of 564 4124 spoolsv.exe 139 PID 4836 set thread context of 4692 4836 spoolsv.exe 141 PID 4356 set thread context of 216 4356 spoolsv.exe 142 PID 3872 set thread context of 2128 3872 spoolsv.exe 144 PID 3112 set thread context of 3752 3112 spoolsv.exe 145 PID 1476 set thread context of 432 1476 spoolsv.exe 147 PID 592 set thread context of 1908 592 spoolsv.exe 149 PID 2500 set thread context of 4372 2500 spoolsv.exe 150 PID 4756 set thread context of 1200 4756 spoolsv.exe 152 PID 640 set thread context of 4112 640 spoolsv.exe 153 PID 3396 set thread context of 1896 3396 spoolsv.exe 155 PID 4536 set thread context of 4432 4536 spoolsv.exe 156 PID 1340 set thread context of 5096 1340 spoolsv.exe 157 PID 464 set thread context of 4240 464 spoolsv.exe 159 PID 4504 set thread context of 548 4504 spoolsv.exe 161 PID 4604 set thread context of 1104 4604 spoolsv.exe 162 PID 2152 set thread context of 1112 2152 spoolsv.exe 163 PID 3960 set thread context of 4288 3960 spoolsv.exe 165 PID 2496 set thread context of 2040 2496 spoolsv.exe 167 PID 1576 set thread context of 3576 1576 spoolsv.exe 168 PID 3900 set thread context of 4472 3900 spoolsv.exe 170 PID 1176 set thread context of 2276 1176 spoolsv.exe 174 PID 3444 set thread context of 3100 3444 explorer.exe 177 PID 2700 set thread context of 1624 2700 spoolsv.exe 181 PID 920 set thread context of 4484 920 explorer.exe 183 PID 4476 set thread context of 2108 4476 spoolsv.exe 185 PID 4628 set thread context of 1516 4628 explorer.exe 187 PID 4688 set thread context of 944 4688 spoolsv.exe 191 PID 3476 set thread context of 3076 3476 explorer.exe 193 PID 4296 set thread context of 4448 4296 spoolsv.exe 196 PID 872 set thread context of 3336 872 explorer.exe 198 PID 1348 set thread context of 1236 1348 spoolsv.exe 202 PID 1896 set thread context of 2884 1896 explorer.exe 205 PID 3196 set thread context of 852 3196 spoolsv.exe 207 PID 912 set thread context of 4508 912 explorer.exe 209 PID 4552 set thread context of 5056 4552 spoolsv.exe 210 PID 208 set thread context of 3996 208 explorer.exe 211 PID 4780 set thread context of 1640 4780 spoolsv.exe 213 PID 1976 set thread context of 5108 1976 spoolsv.exe 214 PID 1428 set thread context of 1800 1428 spoolsv.exe 216 PID 3984 set thread context of 1992 3984 explorer.exe 217 PID 3920 set thread context of 1276 3920 spoolsv.exe 219 PID 2208 set thread context of 220 2208 spoolsv.exe 220 PID 4196 set thread context of 3200 4196 spoolsv.exe 222 PID 2452 set thread context of 2336 2452 explorer.exe 224 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3452 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 4564 spoolsv.exe 4564 spoolsv.exe 4972 spoolsv.exe 4972 spoolsv.exe 4048 spoolsv.exe 4048 spoolsv.exe 4652 spoolsv.exe 4652 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 1212 spoolsv.exe 1212 spoolsv.exe 3148 spoolsv.exe 3148 spoolsv.exe 564 spoolsv.exe 564 spoolsv.exe 4692 spoolsv.exe 4692 spoolsv.exe 216 spoolsv.exe 216 spoolsv.exe 2128 spoolsv.exe 2128 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe 432 spoolsv.exe 432 spoolsv.exe 1908 spoolsv.exe 1908 spoolsv.exe 4372 spoolsv.exe 4372 spoolsv.exe 1200 spoolsv.exe 1200 spoolsv.exe 4112 spoolsv.exe 4112 spoolsv.exe 1896 spoolsv.exe 1896 spoolsv.exe 4432 spoolsv.exe 4432 spoolsv.exe 5096 spoolsv.exe 5096 spoolsv.exe 4240 spoolsv.exe 4240 spoolsv.exe 548 spoolsv.exe 548 spoolsv.exe 1104 spoolsv.exe 1104 spoolsv.exe 1112 spoolsv.exe 1112 spoolsv.exe 4288 spoolsv.exe 4288 spoolsv.exe 2040 spoolsv.exe 2040 spoolsv.exe 3576 spoolsv.exe 3576 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 2276 spoolsv.exe 2276 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3876 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 83 PID 2564 wrote to memory of 3876 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 83 PID 2564 wrote to memory of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 2564 wrote to memory of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 2564 wrote to memory of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 2564 wrote to memory of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 2564 wrote to memory of 1296 2564 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 88 PID 1296 wrote to memory of 4860 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 89 PID 1296 wrote to memory of 4860 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 89 PID 1296 wrote to memory of 4860 1296 00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe 89 PID 4860 wrote to memory of 3452 4860 explorer.exe 97 PID 4860 wrote to memory of 3452 4860 explorer.exe 97 PID 4860 wrote to memory of 3452 4860 explorer.exe 97 PID 4860 wrote to memory of 3452 4860 explorer.exe 97 PID 4860 wrote to memory of 3452 4860 explorer.exe 97 PID 3452 wrote to memory of 1324 3452 explorer.exe 98 PID 3452 wrote to memory of 1324 3452 explorer.exe 98 PID 3452 wrote to memory of 1324 3452 explorer.exe 98 PID 3452 wrote to memory of 4752 3452 explorer.exe 99 PID 3452 wrote to memory of 4752 3452 explorer.exe 99 PID 3452 wrote to memory of 4752 3452 explorer.exe 99 PID 3452 wrote to memory of 5092 3452 explorer.exe 100 PID 3452 wrote to memory of 5092 3452 explorer.exe 100 PID 3452 wrote to memory of 5092 3452 explorer.exe 100 PID 3452 wrote to memory of 4636 3452 explorer.exe 101 PID 3452 wrote to memory of 4636 3452 explorer.exe 101 PID 3452 wrote to memory of 4636 3452 explorer.exe 101 PID 3452 wrote to memory of 4212 3452 explorer.exe 102 PID 3452 wrote to memory of 4212 3452 explorer.exe 102 PID 3452 wrote to memory of 4212 3452 explorer.exe 102 PID 3452 wrote to memory of 3184 3452 explorer.exe 103 PID 3452 wrote to memory of 3184 3452 explorer.exe 103 PID 3452 wrote to memory of 3184 3452 explorer.exe 103 PID 3452 wrote to memory of 60 3452 explorer.exe 104 PID 3452 wrote to memory of 60 3452 explorer.exe 104 PID 3452 wrote to memory of 60 3452 explorer.exe 104 PID 3452 wrote to memory of 4124 3452 explorer.exe 105 PID 3452 wrote to memory of 4124 3452 explorer.exe 105 PID 3452 wrote to memory of 4124 3452 explorer.exe 105 PID 3452 wrote to memory of 4836 3452 explorer.exe 106 PID 3452 wrote to memory of 4836 3452 explorer.exe 106 PID 3452 wrote to memory of 4836 3452 explorer.exe 106 PID 3452 wrote to memory of 4356 3452 explorer.exe 109 PID 3452 wrote to memory of 4356 3452 explorer.exe 109 PID 3452 wrote to memory of 4356 3452 explorer.exe 109 PID 3452 wrote to memory of 3872 3452 explorer.exe 110 PID 3452 wrote to memory of 3872 3452 explorer.exe 110 PID 3452 wrote to memory of 3872 3452 explorer.exe 110 PID 3452 wrote to memory of 3112 3452 explorer.exe 111 PID 3452 wrote to memory of 3112 3452 explorer.exe 111 PID 3452 wrote to memory of 3112 3452 explorer.exe 111 PID 3452 wrote to memory of 1476 3452 explorer.exe 112 PID 3452 wrote to memory of 1476 3452 explorer.exe 112 PID 3452 wrote to memory of 1476 3452 explorer.exe 112 PID 3452 wrote to memory of 592 3452 explorer.exe 113 PID 3452 wrote to memory of 592 3452 explorer.exe 113 PID 3452 wrote to memory of 592 3452 explorer.exe 113 PID 3452 wrote to memory of 2500 3452 explorer.exe 114 PID 3452 wrote to memory of 2500 3452 explorer.exe 114 PID 3452 wrote to memory of 2500 3452 explorer.exe 114 PID 3452 wrote to memory of 4756 3452 explorer.exe 115 PID 3452 wrote to memory of 4756 3452 explorer.exe 115 PID 3452 wrote to memory of 4756 3452 explorer.exe 115 PID 3452 wrote to memory of 640 3452 explorer.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3876
-
-
C:\Users\Admin\AppData\Local\Temp\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00f38758786b84b1d6f9cf344fa44111_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1324 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3444 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3100
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:920 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4484
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4692
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4628 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1516
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3476 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3076
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4372
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4112 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:872 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3336
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4240 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1896 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2884
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:912 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4508
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4472 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:208 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3996
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2276 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3984 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1992
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1624
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2336
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2060
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:944
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1844
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4448
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3676
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1236
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2328
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:852
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4360
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1640
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3796
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1800
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1276
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3200
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5028
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4024
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1232
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3092
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2924
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2456
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2100
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD508379da6a5b5a7a14d8507a76ca89b34
SHA17290b4d1292061289e64e20661526b113e9bac87
SHA256b461eac74198b9637be17f7b5e76ba674a5ddae0e9a7c5977669b128c03acc48
SHA512819ac09b270179463b5049398e61345f803ca99bcd436e898fcbacf56f640d3bb771cdf6fbc41627648ad58714b6a13b253bebb417a97cbcd26b5a833ffe8f14
-
Filesize
2.2MB
MD592d57018dbe66d12500b9aa3a4c50192
SHA13c989840510b0b5360048201a93d350ac8c59158
SHA25667e56511f2ee1e8a8a89a584a82716162e664102ee073c49f270b96133c9441c
SHA512f25f5d598ebd098f30dd1109dcf86256dc785cc5b5b4647349ff2e076d038f90ce4194108e309e2e5295cc7ea43f1393a2dfb19bac3ad45cf7d86b8d22f2fb91