Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 18:42
Behavioral task
behavioral1
Sample
016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
016a6c28943b8f3c29474519728fd307
-
SHA1
7499219ea1a3dd9dbfb0bef0c20140954231308c
-
SHA256
608c436a0553106303959bce5aeb13c2d05a905fd84a171e2890f81b49d9ce23
-
SHA512
15d6bddea51990e1b034138799c06aef263c1ba0916f50232638f9eb282c7d1353f358d0af0ff36e0ce8b298cb47539c49800daf957f8205a1a51f1fb8175eeb
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwY
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3312 explorer.exe 5544 explorer.exe 2028 spoolsv.exe 3244 spoolsv.exe 920 spoolsv.exe 3652 spoolsv.exe 1232 spoolsv.exe 5864 spoolsv.exe 856 spoolsv.exe 3200 spoolsv.exe 5892 spoolsv.exe 4704 spoolsv.exe 3752 spoolsv.exe 4960 spoolsv.exe 4348 spoolsv.exe 4648 spoolsv.exe 4728 spoolsv.exe 5484 spoolsv.exe 2424 spoolsv.exe 5560 spoolsv.exe 1444 spoolsv.exe 1084 spoolsv.exe 3376 spoolsv.exe 2636 spoolsv.exe 5696 spoolsv.exe 5800 spoolsv.exe 3440 spoolsv.exe 1408 spoolsv.exe 4528 spoolsv.exe 5772 spoolsv.exe 2152 spoolsv.exe 4776 spoolsv.exe 3680 spoolsv.exe 6016 explorer.exe 5644 spoolsv.exe 5060 spoolsv.exe 2348 spoolsv.exe 1564 spoolsv.exe 736 spoolsv.exe 3780 explorer.exe 1336 spoolsv.exe 2544 spoolsv.exe 1876 spoolsv.exe 5720 explorer.exe 1484 spoolsv.exe 5256 spoolsv.exe 1460 spoolsv.exe 4540 spoolsv.exe 5708 spoolsv.exe 3872 spoolsv.exe 3100 explorer.exe 4496 spoolsv.exe 1440 spoolsv.exe 3616 spoolsv.exe 3572 spoolsv.exe 3592 spoolsv.exe 768 explorer.exe 5752 spoolsv.exe 3104 spoolsv.exe 4732 spoolsv.exe 4292 spoolsv.exe 2680 spoolsv.exe 552 explorer.exe 2488 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
description pid Process procid_target PID 528 set thread context of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 3312 set thread context of 5544 3312 explorer.exe 99 PID 2028 set thread context of 3680 2028 spoolsv.exe 132 PID 3244 set thread context of 5644 3244 spoolsv.exe 134 PID 920 set thread context of 5060 920 spoolsv.exe 135 PID 3652 set thread context of 2348 3652 spoolsv.exe 136 PID 1232 set thread context of 736 1232 spoolsv.exe 138 PID 5864 set thread context of 1336 5864 spoolsv.exe 140 PID 856 set thread context of 2544 856 spoolsv.exe 141 PID 3200 set thread context of 1876 3200 spoolsv.exe 142 PID 5892 set thread context of 5256 5892 spoolsv.exe 145 PID 4704 set thread context of 1460 4704 spoolsv.exe 146 PID 3752 set thread context of 4540 3752 spoolsv.exe 147 PID 4960 set thread context of 5708 4960 spoolsv.exe 148 PID 4348 set thread context of 3872 4348 spoolsv.exe 149 PID 4648 set thread context of 1440 4648 spoolsv.exe 152 PID 4728 set thread context of 3616 4728 spoolsv.exe 153 PID 5484 set thread context of 3572 5484 spoolsv.exe 154 PID 2424 set thread context of 3592 2424 spoolsv.exe 155 PID 5560 set thread context of 5752 5560 spoolsv.exe 157 PID 1444 set thread context of 4732 1444 spoolsv.exe 159 PID 1084 set thread context of 4292 1084 spoolsv.exe 160 PID 3376 set thread context of 2680 3376 spoolsv.exe 161 PID 2636 set thread context of 444 2636 spoolsv.exe 164 PID 5696 set thread context of 5016 5696 spoolsv.exe 165 PID 5800 set thread context of 5612 5800 spoolsv.exe 166 PID 3440 set thread context of 1836 3440 spoolsv.exe 167 PID 1408 set thread context of 3416 1408 spoolsv.exe 170 PID 4528 set thread context of 2964 4528 spoolsv.exe 171 PID 5772 set thread context of 3868 5772 spoolsv.exe 172 PID 2152 set thread context of 4156 2152 spoolsv.exe 174 PID 4776 set thread context of 5692 4776 spoolsv.exe 178 PID 6016 set thread context of 3736 6016 explorer.exe 180 PID 3780 set thread context of 744 3780 explorer.exe 183 PID 1564 set thread context of 1612 1564 spoolsv.exe 184 PID 5720 set thread context of 4556 5720 explorer.exe 189 PID 1484 set thread context of 4976 1484 spoolsv.exe 190 PID 3100 set thread context of 4500 3100 explorer.exe 194 PID 4496 set thread context of 5384 4496 spoolsv.exe 196 PID 768 set thread context of 5344 768 explorer.exe 200 PID 3104 set thread context of 2376 3104 spoolsv.exe 201 PID 552 set thread context of 4292 552 explorer.exe 205 PID 2488 set thread context of 2792 2488 spoolsv.exe 206 PID 5012 set thread context of 4364 5012 explorer.exe 210 PID 4196 set thread context of 5488 4196 spoolsv.exe 211 PID 4800 set thread context of 5700 4800 spoolsv.exe 213 PID 1676 set thread context of 3560 1676 explorer.exe 214 PID 5904 set thread context of 3964 5904 spoolsv.exe 216 PID 964 set thread context of 5232 964 spoolsv.exe 218 PID 1164 set thread context of 1252 1164 explorer.exe 220 PID 2860 set thread context of 4452 2860 spoolsv.exe 221 PID 5156 set thread context of 5372 5156 spoolsv.exe 224 PID 2412 set thread context of 2284 2412 explorer.exe 226 PID 860 set thread context of 2448 860 spoolsv.exe 227 PID 4836 set thread context of 4612 4836 spoolsv.exe 228 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5544 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 3680 spoolsv.exe 3680 spoolsv.exe 5644 spoolsv.exe 5644 spoolsv.exe 5060 spoolsv.exe 5060 spoolsv.exe 2348 spoolsv.exe 2348 spoolsv.exe 736 spoolsv.exe 736 spoolsv.exe 1336 spoolsv.exe 1336 spoolsv.exe 2544 spoolsv.exe 2544 spoolsv.exe 1876 spoolsv.exe 1876 spoolsv.exe 5256 spoolsv.exe 5256 spoolsv.exe 1460 spoolsv.exe 1460 spoolsv.exe 4540 spoolsv.exe 4540 spoolsv.exe 5708 spoolsv.exe 5708 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 1440 spoolsv.exe 1440 spoolsv.exe 3616 spoolsv.exe 3616 spoolsv.exe 3572 spoolsv.exe 3572 spoolsv.exe 3592 spoolsv.exe 3592 spoolsv.exe 5752 spoolsv.exe 5752 spoolsv.exe 4732 spoolsv.exe 4732 spoolsv.exe 4292 spoolsv.exe 4292 spoolsv.exe 2680 spoolsv.exe 2680 spoolsv.exe 444 spoolsv.exe 444 spoolsv.exe 5016 spoolsv.exe 5016 spoolsv.exe 5612 spoolsv.exe 5612 spoolsv.exe 1836 spoolsv.exe 1836 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 2964 spoolsv.exe 2964 spoolsv.exe 3868 spoolsv.exe 3868 spoolsv.exe 4156 spoolsv.exe 4156 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 936 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 85 PID 528 wrote to memory of 936 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 85 PID 528 wrote to memory of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 528 wrote to memory of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 528 wrote to memory of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 528 wrote to memory of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 528 wrote to memory of 5420 528 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 90 PID 5420 wrote to memory of 3312 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 91 PID 5420 wrote to memory of 3312 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 91 PID 5420 wrote to memory of 3312 5420 016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe 91 PID 3312 wrote to memory of 5544 3312 explorer.exe 99 PID 3312 wrote to memory of 5544 3312 explorer.exe 99 PID 3312 wrote to memory of 5544 3312 explorer.exe 99 PID 3312 wrote to memory of 5544 3312 explorer.exe 99 PID 3312 wrote to memory of 5544 3312 explorer.exe 99 PID 5544 wrote to memory of 2028 5544 explorer.exe 100 PID 5544 wrote to memory of 2028 5544 explorer.exe 100 PID 5544 wrote to memory of 2028 5544 explorer.exe 100 PID 5544 wrote to memory of 3244 5544 explorer.exe 101 PID 5544 wrote to memory of 3244 5544 explorer.exe 101 PID 5544 wrote to memory of 3244 5544 explorer.exe 101 PID 5544 wrote to memory of 920 5544 explorer.exe 102 PID 5544 wrote to memory of 920 5544 explorer.exe 102 PID 5544 wrote to memory of 920 5544 explorer.exe 102 PID 5544 wrote to memory of 3652 5544 explorer.exe 103 PID 5544 wrote to memory of 3652 5544 explorer.exe 103 PID 5544 wrote to memory of 3652 5544 explorer.exe 103 PID 5544 wrote to memory of 1232 5544 explorer.exe 104 PID 5544 wrote to memory of 1232 5544 explorer.exe 104 PID 5544 wrote to memory of 1232 5544 explorer.exe 104 PID 5544 wrote to memory of 5864 5544 explorer.exe 105 PID 5544 wrote to memory of 5864 5544 explorer.exe 105 PID 5544 wrote to memory of 5864 5544 explorer.exe 105 PID 5544 wrote to memory of 856 5544 explorer.exe 106 PID 5544 wrote to memory of 856 5544 explorer.exe 106 PID 5544 wrote to memory of 856 5544 explorer.exe 106 PID 5544 wrote to memory of 3200 5544 explorer.exe 107 PID 5544 wrote to memory of 3200 5544 explorer.exe 107 PID 5544 wrote to memory of 3200 5544 explorer.exe 107 PID 5544 wrote to memory of 5892 5544 explorer.exe 108 PID 5544 wrote to memory of 5892 5544 explorer.exe 108 PID 5544 wrote to memory of 5892 5544 explorer.exe 108 PID 5544 wrote to memory of 4704 5544 explorer.exe 109 PID 5544 wrote to memory of 4704 5544 explorer.exe 109 PID 5544 wrote to memory of 4704 5544 explorer.exe 109 PID 5544 wrote to memory of 3752 5544 explorer.exe 112 PID 5544 wrote to memory of 3752 5544 explorer.exe 112 PID 5544 wrote to memory of 3752 5544 explorer.exe 112 PID 5544 wrote to memory of 4960 5544 explorer.exe 113 PID 5544 wrote to memory of 4960 5544 explorer.exe 113 PID 5544 wrote to memory of 4960 5544 explorer.exe 113 PID 5544 wrote to memory of 4348 5544 explorer.exe 114 PID 5544 wrote to memory of 4348 5544 explorer.exe 114 PID 5544 wrote to memory of 4348 5544 explorer.exe 114 PID 5544 wrote to memory of 4648 5544 explorer.exe 115 PID 5544 wrote to memory of 4648 5544 explorer.exe 115 PID 5544 wrote to memory of 4648 5544 explorer.exe 115 PID 5544 wrote to memory of 4728 5544 explorer.exe 116 PID 5544 wrote to memory of 4728 5544 explorer.exe 116 PID 5544 wrote to memory of 4728 5544 explorer.exe 116 PID 5544 wrote to memory of 5484 5544 explorer.exe 117 PID 5544 wrote to memory of 5484 5544 explorer.exe 117 PID 5544 wrote to memory of 5484 5544 explorer.exe 117 PID 5544 wrote to memory of 2424 5544 explorer.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\016a6c28943b8f3c29474519728fd307_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6016 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3736
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5644
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:736 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3780 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:744
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5720 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4556
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5708
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3872 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3100 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4500
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3572
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:768 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5344
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:552 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4292
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1836 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5012 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4364
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3868
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4156 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3560
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1164 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1252
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1612
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:2412 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2284
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4976
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4076
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5384
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5020
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2376
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5888
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2792
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4844
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5488
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4212
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5700
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5232
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5648
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4452
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5156 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5372
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1216
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:780
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2908
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6060
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3612
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD570420638f30e1e1d5c33318b1061c400
SHA117f0318a2922cbd9d4df276d07c308b29c66811a
SHA25643852878cf955716ee22a059c0e5d904109c40d764149516473c5b7e6a7938a8
SHA5124521617542b479f4d3d4d7d72eb3997cb315c4eaaa9ac0058b0b3d6c6391cf5926a8c743bc5d6f656abf2c7d197c1f17ebf88f7d1fd52f84569342cc13de6f6f
-
Filesize
2.2MB
MD5f110e9282c4844129511f07971b7a749
SHA1a333a9e988c0a52a0c4126d6ba691abf2ba66991
SHA256991ab580a0cfc57d68fe8a23673e491390f13cdf94a436b42cc2c74f1c88fd6d
SHA512527d28f10a4a83fefd4acfae3f85e3ee668249b8902d765dcabc71aa9e4772bd3a588c6b4345a7050fc547428b9e4024e344496be79e92c888ffd7112b51c18c