Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:35
Behavioral task
behavioral1
Sample
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0448fdb491446244fcde63790ebce34c
-
SHA1
7a6b7bc0d84a4d191299a2d70cfb4382464803f2
-
SHA256
f557a8fb3ea7c87795e8cfd08f895f94165cfc82e1b4e9e79367af5e7b7139d8
-
SHA512
83f4a424639c21870b293d9f2f371f8fde98d6a9a69c549b8643569e1d930d61c143e93e43f2ae8d511ffa930ac94e7383671b1e70ac83d29d23d56ead33bcaa
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ+:0UzeyQMS4DqodCnoe+iitjWwwC
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exepid process 5000 explorer.exe 4968 explorer.exe 1472 spoolsv.exe 776 spoolsv.exe 2120 spoolsv.exe 1136 spoolsv.exe 4044 spoolsv.exe 2692 spoolsv.exe 1464 spoolsv.exe 4884 spoolsv.exe 5116 spoolsv.exe 2272 spoolsv.exe 968 spoolsv.exe 1844 spoolsv.exe 216 spoolsv.exe 4988 spoolsv.exe 4808 spoolsv.exe 1700 spoolsv.exe 3856 spoolsv.exe 4496 spoolsv.exe 4064 spoolsv.exe 980 spoolsv.exe 1332 spoolsv.exe 3320 spoolsv.exe 3400 spoolsv.exe 1216 spoolsv.exe 1044 spoolsv.exe 3520 spoolsv.exe 4024 spoolsv.exe 5056 spoolsv.exe 3644 spoolsv.exe 2300 spoolsv.exe 4320 spoolsv.exe 2904 explorer.exe 2396 spoolsv.exe 4480 spoolsv.exe 3008 spoolsv.exe 1648 spoolsv.exe 1160 spoolsv.exe 4476 spoolsv.exe 2960 explorer.exe 3596 spoolsv.exe 5104 spoolsv.exe 4552 spoolsv.exe 4232 spoolsv.exe 440 spoolsv.exe 2152 spoolsv.exe 4848 explorer.exe 4280 spoolsv.exe 2052 spoolsv.exe 3944 spoolsv.exe 1156 spoolsv.exe 1712 spoolsv.exe 2172 explorer.exe 3872 spoolsv.exe 4764 spoolsv.exe 748 spoolsv.exe 4416 spoolsv.exe 5000 spoolsv.exe 2536 spoolsv.exe 3160 explorer.exe 1184 spoolsv.exe 4820 spoolsv.exe 4004 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 4468 set thread context of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 5000 set thread context of 4968 5000 explorer.exe explorer.exe PID 1472 set thread context of 4320 1472 spoolsv.exe spoolsv.exe PID 776 set thread context of 2396 776 spoolsv.exe spoolsv.exe PID 2120 set thread context of 4480 2120 spoolsv.exe spoolsv.exe PID 1136 set thread context of 3008 1136 spoolsv.exe spoolsv.exe PID 4044 set thread context of 1160 4044 spoolsv.exe spoolsv.exe PID 2692 set thread context of 4476 2692 spoolsv.exe spoolsv.exe PID 1464 set thread context of 3596 1464 spoolsv.exe spoolsv.exe PID 4884 set thread context of 5104 4884 spoolsv.exe spoolsv.exe PID 5116 set thread context of 4552 5116 spoolsv.exe spoolsv.exe PID 2272 set thread context of 440 2272 spoolsv.exe spoolsv.exe PID 968 set thread context of 2152 968 spoolsv.exe spoolsv.exe PID 1844 set thread context of 4280 1844 spoolsv.exe spoolsv.exe PID 216 set thread context of 2052 216 spoolsv.exe spoolsv.exe PID 4988 set thread context of 1156 4988 spoolsv.exe spoolsv.exe PID 4808 set thread context of 1712 4808 spoolsv.exe spoolsv.exe PID 1700 set thread context of 3872 1700 spoolsv.exe spoolsv.exe PID 3856 set thread context of 748 3856 spoolsv.exe spoolsv.exe PID 4496 set thread context of 4416 4496 spoolsv.exe spoolsv.exe PID 4064 set thread context of 5000 4064 spoolsv.exe spoolsv.exe PID 980 set thread context of 2536 980 spoolsv.exe spoolsv.exe PID 1332 set thread context of 4820 1332 spoolsv.exe spoolsv.exe PID 3320 set thread context of 4004 3320 spoolsv.exe spoolsv.exe PID 3400 set thread context of 1264 3400 spoolsv.exe spoolsv.exe PID 1216 set thread context of 5068 1216 spoolsv.exe spoolsv.exe PID 1044 set thread context of 2704 1044 spoolsv.exe spoolsv.exe PID 3520 set thread context of 2916 3520 spoolsv.exe spoolsv.exe PID 5056 set thread context of 4300 5056 spoolsv.exe spoolsv.exe PID 3644 set thread context of 2320 3644 spoolsv.exe spoolsv.exe PID 2300 set thread context of 3600 2300 spoolsv.exe spoolsv.exe PID 2904 set thread context of 3124 2904 explorer.exe explorer.exe PID 1648 set thread context of 4892 1648 spoolsv.exe spoolsv.exe PID 2960 set thread context of 4952 2960 explorer.exe explorer.exe PID 4232 set thread context of 5044 4232 spoolsv.exe spoolsv.exe PID 4848 set thread context of 2480 4848 explorer.exe explorer.exe PID 3944 set thread context of 264 3944 spoolsv.exe spoolsv.exe PID 2172 set thread context of 4864 2172 explorer.exe explorer.exe PID 4764 set thread context of 4456 4764 spoolsv.exe spoolsv.exe PID 3160 set thread context of 2480 3160 explorer.exe explorer.exe PID 1184 set thread context of 2452 1184 spoolsv.exe spoolsv.exe PID 1596 set thread context of 4784 1596 spoolsv.exe spoolsv.exe PID 4468 set thread context of 1916 4468 explorer.exe explorer.exe PID 4788 set thread context of 2032 4788 spoolsv.exe spoolsv.exe PID 3568 set thread context of 448 3568 explorer.exe explorer.exe PID 2860 set thread context of 2724 2860 spoolsv.exe spoolsv.exe PID 2072 set thread context of 4712 2072 spoolsv.exe spoolsv.exe PID 220 set thread context of 4852 220 spoolsv.exe spoolsv.exe PID 3728 set thread context of 3792 3728 explorer.exe explorer.exe PID 808 set thread context of 3340 808 spoolsv.exe spoolsv.exe PID 464 set thread context of 3196 464 spoolsv.exe spoolsv.exe PID 428 set thread context of 2328 428 spoolsv.exe spoolsv.exe PID 640 set thread context of 3240 640 explorer.exe explorer.exe PID 1636 set thread context of 3576 1636 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe0448fdb491446244fcde63790ebce34c_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exe0448fdb491446244fcde63790ebce34c_JaffaCakes118.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exeexplorer.exepid process 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4968 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4968 explorer.exe 4320 spoolsv.exe 4320 spoolsv.exe 2396 spoolsv.exe 2396 spoolsv.exe 4480 spoolsv.exe 4480 spoolsv.exe 3008 spoolsv.exe 3008 spoolsv.exe 1160 spoolsv.exe 1160 spoolsv.exe 4476 spoolsv.exe 4476 spoolsv.exe 3596 spoolsv.exe 3596 spoolsv.exe 5104 spoolsv.exe 5104 spoolsv.exe 4552 spoolsv.exe 4552 spoolsv.exe 440 spoolsv.exe 440 spoolsv.exe 2152 spoolsv.exe 2152 spoolsv.exe 4280 spoolsv.exe 4280 spoolsv.exe 2052 spoolsv.exe 2052 spoolsv.exe 1156 spoolsv.exe 1156 spoolsv.exe 1712 spoolsv.exe 1712 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 748 spoolsv.exe 748 spoolsv.exe 4416 spoolsv.exe 4416 spoolsv.exe 5000 spoolsv.exe 5000 spoolsv.exe 2536 spoolsv.exe 2536 spoolsv.exe 4820 spoolsv.exe 4820 spoolsv.exe 4004 spoolsv.exe 4004 spoolsv.exe 1264 spoolsv.exe 1264 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 2704 spoolsv.exe 2704 spoolsv.exe 2916 spoolsv.exe 2916 spoolsv.exe 3964 spoolsv.exe 3964 spoolsv.exe 4300 spoolsv.exe 4300 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe0448fdb491446244fcde63790ebce34c_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4468 wrote to memory of 3004 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe splwow64.exe PID 4468 wrote to memory of 3004 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe splwow64.exe PID 4468 wrote to memory of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 4468 wrote to memory of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 4468 wrote to memory of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 4468 wrote to memory of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 4468 wrote to memory of 1592 4468 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe PID 1592 wrote to memory of 5000 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe explorer.exe PID 1592 wrote to memory of 5000 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe explorer.exe PID 1592 wrote to memory of 5000 1592 0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe explorer.exe PID 5000 wrote to memory of 4968 5000 explorer.exe explorer.exe PID 5000 wrote to memory of 4968 5000 explorer.exe explorer.exe PID 5000 wrote to memory of 4968 5000 explorer.exe explorer.exe PID 5000 wrote to memory of 4968 5000 explorer.exe explorer.exe PID 5000 wrote to memory of 4968 5000 explorer.exe explorer.exe PID 4968 wrote to memory of 1472 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1472 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1472 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 776 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 776 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 776 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2120 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2120 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2120 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1136 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1136 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1136 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4044 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4044 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4044 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2692 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2692 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2692 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1464 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1464 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1464 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4884 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4884 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4884 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 5116 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 5116 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 5116 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2272 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2272 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 2272 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 968 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 968 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 968 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1844 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1844 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1844 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 216 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 216 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 216 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4988 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4988 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4988 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4808 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4808 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 4808 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1700 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1700 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 1700 4968 explorer.exe spoolsv.exe PID 4968 wrote to memory of 3856 4968 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0448fdb491446244fcde63790ebce34c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4320 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2904 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4476 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2960 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5104 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2152 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4848 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2172 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2536 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3160 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5068 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2916 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:4024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4300 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3568 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2320 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3600
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3728 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4892
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5044
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:264
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4456
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2116 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2452
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4784
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2032
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2724
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4852
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2292
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4444
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3824 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4376 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3276
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD555a6fa28e3feddf5dff592d62e2c103f
SHA18486745e026bfbe33ac9a2925bdae5c16fd41747
SHA256ac0ba9ca621a2ad61b10fb49c236c0c16a922f2800dd217f1889f49025e7f9ff
SHA51274ca22fc6544eabd1014fa16d7c61e9ef26c65924f867771007ec25a9df168d5c8c5362f87957d77f13a3d4345c254e3fd476a6b23db5cc413debf0cf7ea8f86
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD59d4e010355ea37a671e7aa7a1eabee8a
SHA1188b45e8da78d8efbfeda6126dfa5716e8ab2930
SHA256eff5b4057c4fe4f7fe0757036b175e8a6c554606b80a3add15126cecfd649932
SHA5121aca9f2921528688e37685b47a820050dda1d46b7c72094dd0d3f41c7d41f5fe729f62c12ff24b5d912fec9fa466b5db7078f9e7b6aebd35422f95e47df18a15
-
memory/216-1625-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/264-3886-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/440-2197-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/448-4478-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/748-2550-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/776-1852-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/776-965-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/968-1450-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/980-1848-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1136-967-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1156-2411-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1160-1960-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1332-1855-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1464-1165-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1472-818-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1472-1844-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1592-41-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1592-42-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1592-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1700-1751-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1712-2466-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1844-1451-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1916-4382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2032-4469-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2052-2304-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2120-966-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-1872-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2152-2285-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2152-2450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2272-1449-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2320-2978-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2328-4921-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2396-1860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2396-1858-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2452-4172-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2452-4285-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2480-3668-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2480-4109-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2536-2770-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2536-2629-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2692-1164-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2724-4554-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2724-4712-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2916-2876-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3008-1880-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3124-3220-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3196-4754-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3196-4758-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3240-4930-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3320-1869-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3340-4746-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3400-1879-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3576-4939-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3596-2084-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3600-3278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3600-3151-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3792-4742-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3856-1752-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3872-2475-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3964-2889-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3964-2882-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4004-2719-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4044-1163-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4064-1847-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4280-2295-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4300-2969-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4300-3005-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-1849-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-2056-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4416-2562-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4456-3987-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4456-4091-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4468-36-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4468-0-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/4468-38-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/4468-43-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4476-2073-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4476-2267-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4480-1866-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4480-1870-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4496-1753-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4552-2145-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4784-4371-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4784-4521-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4808-1627-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4820-2708-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4852-4890-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4852-4729-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4864-3909-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4884-1336-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4892-3525-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4892-3395-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4952-3482-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4968-817-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4968-83-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4988-1626-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5000-2570-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5000-84-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5000-79-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5012-5027-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5012-5039-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5044-3657-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5044-3761-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5068-2852-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5068-2945-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5104-2093-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5116-1337-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB