Analysis
-
max time kernel
150s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 02:17
Behavioral task
behavioral1
Sample
023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
023109ca34fd50dd0544b021887f2802
-
SHA1
74872d23826a73962fab56582c41bb2adeef2e41
-
SHA256
e62f9e983d1a4ccd83699804f18666f128a8cc8712560dd967b664c3db9c9d67
-
SHA512
def26e5f981a3a72480a65d0e66d0b1c5a147d07320f932d9e81fce3d14527080d4bbe1dcb04103c309abd7501025d137931b9929e4d84d26c209a797de6a58e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWwwP
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 448 explorer.exe 1256 explorer.exe 736 spoolsv.exe 336 spoolsv.exe 2796 spoolsv.exe 4924 spoolsv.exe 3768 spoolsv.exe 2880 spoolsv.exe 2644 spoolsv.exe 2000 spoolsv.exe 4888 spoolsv.exe 5092 spoolsv.exe 3244 spoolsv.exe 2420 spoolsv.exe 1808 spoolsv.exe 536 spoolsv.exe 4200 spoolsv.exe 4080 spoolsv.exe 2732 spoolsv.exe 64 spoolsv.exe 2728 spoolsv.exe 5100 spoolsv.exe 1340 spoolsv.exe 5028 spoolsv.exe 4672 spoolsv.exe 2172 spoolsv.exe 1532 spoolsv.exe 864 spoolsv.exe 2924 spoolsv.exe 2164 spoolsv.exe 2992 spoolsv.exe 4820 spoolsv.exe 2964 explorer.exe 2296 spoolsv.exe 1752 spoolsv.exe 744 spoolsv.exe 1552 spoolsv.exe 3560 spoolsv.exe 3648 explorer.exe 1452 spoolsv.exe 3620 spoolsv.exe 396 spoolsv.exe 5044 spoolsv.exe 1968 spoolsv.exe 3624 spoolsv.exe 2612 spoolsv.exe 4060 explorer.exe 528 spoolsv.exe 4520 spoolsv.exe 3952 spoolsv.exe 2864 spoolsv.exe 3104 spoolsv.exe 2008 spoolsv.exe 2940 spoolsv.exe 2248 explorer.exe 1416 spoolsv.exe 1576 spoolsv.exe 3344 spoolsv.exe 1832 spoolsv.exe 4232 explorer.exe 3752 spoolsv.exe 1092 spoolsv.exe 1888 spoolsv.exe 216 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
description pid Process procid_target PID 2344 set thread context of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 448 set thread context of 1256 448 explorer.exe 99 PID 736 set thread context of 4820 736 spoolsv.exe 129 PID 336 set thread context of 2296 336 spoolsv.exe 131 PID 2796 set thread context of 744 2796 spoolsv.exe 133 PID 4924 set thread context of 1552 4924 spoolsv.exe 134 PID 3768 set thread context of 3560 3768 spoolsv.exe 135 PID 2880 set thread context of 1452 2880 spoolsv.exe 137 PID 2644 set thread context of 3620 2644 spoolsv.exe 138 PID 2000 set thread context of 396 2000 spoolsv.exe 139 PID 4888 set thread context of 5044 4888 spoolsv.exe 140 PID 5092 set thread context of 3624 5092 spoolsv.exe 142 PID 3244 set thread context of 2612 3244 spoolsv.exe 143 PID 2420 set thread context of 528 2420 spoolsv.exe 145 PID 1808 set thread context of 4520 1808 spoolsv.exe 146 PID 536 set thread context of 3952 536 spoolsv.exe 147 PID 4200 set thread context of 2864 4200 spoolsv.exe 148 PID 4080 set thread context of 2008 4080 spoolsv.exe 150 PID 2732 set thread context of 2940 2732 spoolsv.exe 151 PID 64 set thread context of 1416 64 spoolsv.exe 153 PID 2728 set thread context of 1576 2728 spoolsv.exe 154 PID 5100 set thread context of 1832 5100 spoolsv.exe 156 PID 1340 set thread context of 3752 1340 spoolsv.exe 158 PID 5028 set thread context of 1092 5028 spoolsv.exe 159 PID 4672 set thread context of 216 4672 spoolsv.exe 161 PID 2172 set thread context of 4268 2172 spoolsv.exe 163 PID 1532 set thread context of 3184 1532 spoolsv.exe 164 PID 864 set thread context of 4464 864 spoolsv.exe 166 PID 2924 set thread context of 704 2924 spoolsv.exe 167 PID 2164 set thread context of 3936 2164 spoolsv.exe 169 PID 2992 set thread context of 3724 2992 spoolsv.exe 172 PID 2964 set thread context of 1216 2964 explorer.exe 174 PID 1752 set thread context of 436 1752 spoolsv.exe 179 PID 3648 set thread context of 2628 3648 explorer.exe 181 PID 1968 set thread context of 220 1968 spoolsv.exe 186 PID 4060 set thread context of 4360 4060 explorer.exe 189 PID 3104 set thread context of 4328 3104 spoolsv.exe 192 PID 2248 set thread context of 1796 2248 explorer.exe 194 PID 3344 set thread context of 4008 3344 spoolsv.exe 197 PID 4232 set thread context of 3276 4232 explorer.exe 199 PID 1888 set thread context of 2152 1888 spoolsv.exe 202 PID 3128 set thread context of 4424 3128 explorer.exe 204 PID 440 set thread context of 3972 440 spoolsv.exe 206 PID 3068 set thread context of 244 3068 explorer.exe 208 PID 4856 set thread context of 3656 4856 spoolsv.exe 209 PID 768 set thread context of 4620 768 spoolsv.exe 211 PID 4468 set thread context of 456 4468 explorer.exe 213 PID 412 set thread context of 3036 412 spoolsv.exe 215 PID 760 set thread context of 3544 760 spoolsv.exe 216 PID 612 set thread context of 1792 612 spoolsv.exe 218 PID 3584 set thread context of 2608 3584 spoolsv.exe 221 PID 2376 set thread context of 2852 2376 explorer.exe 222 PID 1304 set thread context of 3236 1304 spoolsv.exe 223 PID 4912 set thread context of 3928 4912 spoolsv.exe 224 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 1256 explorer.exe 4820 spoolsv.exe 4820 spoolsv.exe 2296 spoolsv.exe 2296 spoolsv.exe 744 spoolsv.exe 744 spoolsv.exe 1552 spoolsv.exe 1552 spoolsv.exe 3560 spoolsv.exe 3560 spoolsv.exe 1452 spoolsv.exe 1452 spoolsv.exe 3620 spoolsv.exe 3620 spoolsv.exe 396 spoolsv.exe 396 spoolsv.exe 5044 spoolsv.exe 5044 spoolsv.exe 3624 spoolsv.exe 3624 spoolsv.exe 2612 spoolsv.exe 2612 spoolsv.exe 528 spoolsv.exe 528 spoolsv.exe 4520 spoolsv.exe 4520 spoolsv.exe 3952 spoolsv.exe 3952 spoolsv.exe 2864 spoolsv.exe 2864 spoolsv.exe 2008 spoolsv.exe 2008 spoolsv.exe 2940 spoolsv.exe 2940 spoolsv.exe 1416 spoolsv.exe 1416 spoolsv.exe 1576 spoolsv.exe 1576 spoolsv.exe 1832 spoolsv.exe 1832 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe 1092 spoolsv.exe 1092 spoolsv.exe 216 spoolsv.exe 216 spoolsv.exe 4268 spoolsv.exe 4268 spoolsv.exe 3184 spoolsv.exe 3184 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 704 spoolsv.exe 704 spoolsv.exe 3936 spoolsv.exe 3936 spoolsv.exe 3724 spoolsv.exe 3724 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 4276 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 83 PID 2344 wrote to memory of 4276 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 83 PID 2344 wrote to memory of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 2344 wrote to memory of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 2344 wrote to memory of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 2344 wrote to memory of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 2344 wrote to memory of 3820 2344 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 88 PID 3820 wrote to memory of 448 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 89 PID 3820 wrote to memory of 448 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 89 PID 3820 wrote to memory of 448 3820 023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe 89 PID 448 wrote to memory of 1256 448 explorer.exe 99 PID 448 wrote to memory of 1256 448 explorer.exe 99 PID 448 wrote to memory of 1256 448 explorer.exe 99 PID 448 wrote to memory of 1256 448 explorer.exe 99 PID 448 wrote to memory of 1256 448 explorer.exe 99 PID 1256 wrote to memory of 736 1256 explorer.exe 100 PID 1256 wrote to memory of 736 1256 explorer.exe 100 PID 1256 wrote to memory of 736 1256 explorer.exe 100 PID 1256 wrote to memory of 336 1256 explorer.exe 101 PID 1256 wrote to memory of 336 1256 explorer.exe 101 PID 1256 wrote to memory of 336 1256 explorer.exe 101 PID 1256 wrote to memory of 2796 1256 explorer.exe 102 PID 1256 wrote to memory of 2796 1256 explorer.exe 102 PID 1256 wrote to memory of 2796 1256 explorer.exe 102 PID 1256 wrote to memory of 4924 1256 explorer.exe 103 PID 1256 wrote to memory of 4924 1256 explorer.exe 103 PID 1256 wrote to memory of 4924 1256 explorer.exe 103 PID 1256 wrote to memory of 3768 1256 explorer.exe 104 PID 1256 wrote to memory of 3768 1256 explorer.exe 104 PID 1256 wrote to memory of 3768 1256 explorer.exe 104 PID 1256 wrote to memory of 2880 1256 explorer.exe 105 PID 1256 wrote to memory of 2880 1256 explorer.exe 105 PID 1256 wrote to memory of 2880 1256 explorer.exe 105 PID 1256 wrote to memory of 2644 1256 explorer.exe 106 PID 1256 wrote to memory of 2644 1256 explorer.exe 106 PID 1256 wrote to memory of 2644 1256 explorer.exe 106 PID 1256 wrote to memory of 2000 1256 explorer.exe 107 PID 1256 wrote to memory of 2000 1256 explorer.exe 107 PID 1256 wrote to memory of 2000 1256 explorer.exe 107 PID 1256 wrote to memory of 4888 1256 explorer.exe 108 PID 1256 wrote to memory of 4888 1256 explorer.exe 108 PID 1256 wrote to memory of 4888 1256 explorer.exe 108 PID 1256 wrote to memory of 5092 1256 explorer.exe 109 PID 1256 wrote to memory of 5092 1256 explorer.exe 109 PID 1256 wrote to memory of 5092 1256 explorer.exe 109 PID 1256 wrote to memory of 3244 1256 explorer.exe 110 PID 1256 wrote to memory of 3244 1256 explorer.exe 110 PID 1256 wrote to memory of 3244 1256 explorer.exe 110 PID 1256 wrote to memory of 2420 1256 explorer.exe 111 PID 1256 wrote to memory of 2420 1256 explorer.exe 111 PID 1256 wrote to memory of 2420 1256 explorer.exe 111 PID 1256 wrote to memory of 1808 1256 explorer.exe 112 PID 1256 wrote to memory of 1808 1256 explorer.exe 112 PID 1256 wrote to memory of 1808 1256 explorer.exe 112 PID 1256 wrote to memory of 536 1256 explorer.exe 113 PID 1256 wrote to memory of 536 1256 explorer.exe 113 PID 1256 wrote to memory of 536 1256 explorer.exe 113 PID 1256 wrote to memory of 4200 1256 explorer.exe 114 PID 1256 wrote to memory of 4200 1256 explorer.exe 114 PID 1256 wrote to memory of 4200 1256 explorer.exe 114 PID 1256 wrote to memory of 4080 1256 explorer.exe 115 PID 1256 wrote to memory of 4080 1256 explorer.exe 115 PID 1256 wrote to memory of 4080 1256 explorer.exe 115 PID 1256 wrote to memory of 2732 1256 explorer.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4276
-
-
C:\Users\Admin\AppData\Local\Temp\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\023109ca34fd50dd0544b021887f2802_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2964 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1216
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:744
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3560 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2612 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4060 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4360
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2940 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1796
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:64 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4232 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3276
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3128 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4424
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4268
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3184
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:704 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3068 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:244
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3936
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3724 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:456
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:436
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2852
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:220
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:912
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4612
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4008
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4584
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2152
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4640
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3972
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3040
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3656
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4620
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4476
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3036
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3544
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1792
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3604
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4340
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4004
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3424
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2912
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4712
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD559f89362360e39f2c388ce0fe4b876cc
SHA15a9f1a2042dcbf89dce51b87d576ac6488d2be67
SHA25672411315c08bda10cbc6290e2bcce1e0c5bbe88d6dd95bac519d6a3ecbf06360
SHA5122d8bec856ba47548689e85501017a9a8ac7307a1edf371603e66608a09f48e4eab8154975d66a76b167884c7eaa2f2fc4047f2322d507673ab259fffe4c5e456
-
Filesize
2.2MB
MD59375dff301d222c681829e238fedd111
SHA1fc53e165596e6536eb0802b9cefe546057b077b8
SHA256089eabd0607fc83e30e507760032bd458aac8e30d9153ae1ca4a9ceaa8ba6ebc
SHA5126f5628c243d32916b8b1a524eda670951cab75813bbf054ec7f9118d316bacd473ffe072f88c4c7c30bcf78572d7fbcb49a86b9c31a5e49fae688451583f3515