Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:25
Behavioral task
behavioral1
Sample
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
045ebb38c3f6d258560735db9e7291bd
-
SHA1
ae6d2a569d990f65a9ad0cf6a42ec27fa230ccf7
-
SHA256
a2f48cb8f05c2a987bee58d87173e2304e7361167933a6743dfd13af9cb3ae66
-
SHA512
88e2178a34aa81255d210a19fcb75a90f82e1563e53b5620ca2b2219d6b7da67879b6e717d09f35e8d80bfdf24589cd06d1a2ff95b4ab514182ac7b2f901fff1
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZf:0UzeyQMS4DqodCnoe+iitjWwwj
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 4456 explorer.exe 208 explorer.exe 4144 spoolsv.exe 4752 spoolsv.exe 1272 spoolsv.exe 1864 spoolsv.exe 1220 spoolsv.exe 3344 spoolsv.exe 3244 spoolsv.exe 1236 spoolsv.exe 404 spoolsv.exe 3476 spoolsv.exe 3896 spoolsv.exe 2020 spoolsv.exe 2560 spoolsv.exe 5052 spoolsv.exe 4652 spoolsv.exe 3036 spoolsv.exe 1924 spoolsv.exe 2388 spoolsv.exe 2916 spoolsv.exe 2608 spoolsv.exe 3328 spoolsv.exe 3644 spoolsv.exe 4040 spoolsv.exe 4508 spoolsv.exe 1124 spoolsv.exe 4264 spoolsv.exe 2552 spoolsv.exe 1952 spoolsv.exe 452 spoolsv.exe 2996 spoolsv.exe 1344 spoolsv.exe 2596 spoolsv.exe 2600 spoolsv.exe 840 spoolsv.exe 4768 spoolsv.exe 4472 spoolsv.exe 3740 spoolsv.exe 320 explorer.exe 612 spoolsv.exe 4932 spoolsv.exe 212 spoolsv.exe 664 spoolsv.exe 4036 spoolsv.exe 1768 spoolsv.exe 4800 spoolsv.exe 3944 spoolsv.exe 3820 explorer.exe 4420 spoolsv.exe 848 spoolsv.exe 212 spoolsv.exe 216 spoolsv.exe 2072 spoolsv.exe 448 spoolsv.exe 536 spoolsv.exe 816 spoolsv.exe 3132 spoolsv.exe 3128 spoolsv.exe 2952 spoolsv.exe 5100 spoolsv.exe 4376 explorer.exe 2684 spoolsv.exe 4164 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 60 IoCs
Processes:
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1884 set thread context of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 4456 set thread context of 208 4456 explorer.exe explorer.exe PID 4144 set thread context of 3740 4144 spoolsv.exe spoolsv.exe PID 4752 set thread context of 612 4752 spoolsv.exe spoolsv.exe PID 1272 set thread context of 212 1272 spoolsv.exe spoolsv.exe PID 1864 set thread context of 664 1864 spoolsv.exe spoolsv.exe PID 1220 set thread context of 4036 1220 spoolsv.exe spoolsv.exe PID 3344 set thread context of 1768 3344 spoolsv.exe spoolsv.exe PID 3244 set thread context of 4800 3244 spoolsv.exe spoolsv.exe PID 1236 set thread context of 3944 1236 spoolsv.exe spoolsv.exe PID 404 set thread context of 848 404 spoolsv.exe spoolsv.exe PID 3476 set thread context of 212 3476 spoolsv.exe spoolsv.exe PID 3896 set thread context of 216 3896 spoolsv.exe spoolsv.exe PID 2020 set thread context of 2072 2020 spoolsv.exe spoolsv.exe PID 2560 set thread context of 448 2560 spoolsv.exe spoolsv.exe PID 5052 set thread context of 536 5052 spoolsv.exe spoolsv.exe PID 4652 set thread context of 816 4652 spoolsv.exe spoolsv.exe PID 3036 set thread context of 3132 3036 spoolsv.exe spoolsv.exe PID 1924 set thread context of 2952 1924 spoolsv.exe spoolsv.exe PID 2388 set thread context of 5100 2388 spoolsv.exe spoolsv.exe PID 2916 set thread context of 2684 2916 spoolsv.exe spoolsv.exe PID 2608 set thread context of 4164 2608 spoolsv.exe spoolsv.exe PID 3328 set thread context of 2924 3328 spoolsv.exe spoolsv.exe PID 3644 set thread context of 3308 3644 spoolsv.exe spoolsv.exe PID 4040 set thread context of 1356 4040 spoolsv.exe spoolsv.exe PID 4508 set thread context of 1752 4508 spoolsv.exe spoolsv.exe PID 1124 set thread context of 740 1124 spoolsv.exe spoolsv.exe PID 4264 set thread context of 1720 4264 spoolsv.exe spoolsv.exe PID 2552 set thread context of 3568 2552 spoolsv.exe spoolsv.exe PID 1952 set thread context of 628 1952 spoolsv.exe spoolsv.exe PID 452 set thread context of 3160 452 spoolsv.exe spoolsv.exe PID 2996 set thread context of 1520 2996 spoolsv.exe spoolsv.exe PID 1344 set thread context of 4660 1344 spoolsv.exe spoolsv.exe PID 2596 set thread context of 1980 2596 spoolsv.exe spoolsv.exe PID 2600 set thread context of 3852 2600 spoolsv.exe spoolsv.exe PID 840 set thread context of 2540 840 spoolsv.exe spoolsv.exe PID 4768 set thread context of 4056 4768 spoolsv.exe spoolsv.exe PID 4472 set thread context of 4732 4472 spoolsv.exe spoolsv.exe PID 320 set thread context of 4372 320 explorer.exe explorer.exe PID 4932 set thread context of 3396 4932 spoolsv.exe spoolsv.exe PID 4420 set thread context of 748 4420 spoolsv.exe spoolsv.exe PID 3820 set thread context of 4964 3820 explorer.exe explorer.exe PID 4376 set thread context of 2820 4376 explorer.exe explorer.exe PID 3128 set thread context of 2040 3128 spoolsv.exe spoolsv.exe PID 3312 set thread context of 3504 3312 spoolsv.exe spoolsv.exe PID 4356 set thread context of 1340 4356 explorer.exe explorer.exe PID 636 set thread context of 5076 636 spoolsv.exe spoolsv.exe PID 1044 set thread context of 3264 1044 explorer.exe explorer.exe PID 1844 set thread context of 2800 1844 spoolsv.exe spoolsv.exe PID 3212 set thread context of 532 3212 spoolsv.exe spoolsv.exe PID 3064 set thread context of 3480 3064 explorer.exe explorer.exe PID 4832 set thread context of 4056 4832 spoolsv.exe spoolsv.exe PID 1612 set thread context of 4340 1612 spoolsv.exe spoolsv.exe PID 2688 set thread context of 1972 2688 spoolsv.exe spoolsv.exe PID 5068 set thread context of 4924 5068 spoolsv.exe spoolsv.exe PID 1652 set thread context of 3920 1652 explorer.exe explorer.exe PID 4220 set thread context of 2132 4220 spoolsv.exe spoolsv.exe PID 2380 set thread context of 2976 2380 spoolsv.exe spoolsv.exe PID 1596 set thread context of 2456 1596 spoolsv.exe spoolsv.exe PID 1152 set thread context of 2404 1152 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exe045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exeexplorer.exepid process 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 208 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 208 explorer.exe 3740 spoolsv.exe 3740 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 664 spoolsv.exe 664 spoolsv.exe 4036 spoolsv.exe 4036 spoolsv.exe 1768 spoolsv.exe 1768 spoolsv.exe 4800 spoolsv.exe 4800 spoolsv.exe 3944 spoolsv.exe 3944 spoolsv.exe 848 spoolsv.exe 848 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 216 spoolsv.exe 216 spoolsv.exe 2072 spoolsv.exe 2072 spoolsv.exe 448 spoolsv.exe 448 spoolsv.exe 536 spoolsv.exe 536 spoolsv.exe 816 spoolsv.exe 816 spoolsv.exe 3132 spoolsv.exe 3132 spoolsv.exe 2952 spoolsv.exe 2952 spoolsv.exe 5100 spoolsv.exe 5100 spoolsv.exe 2684 spoolsv.exe 2684 spoolsv.exe 4164 spoolsv.exe 4164 spoolsv.exe 2924 spoolsv.exe 2924 spoolsv.exe 3308 spoolsv.exe 3308 spoolsv.exe 1356 spoolsv.exe 1356 spoolsv.exe 1752 spoolsv.exe 1752 spoolsv.exe 740 spoolsv.exe 740 spoolsv.exe 1720 spoolsv.exe 1720 spoolsv.exe 3568 spoolsv.exe 3568 spoolsv.exe 628 spoolsv.exe 628 spoolsv.exe 3160 spoolsv.exe 3160 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1884 wrote to memory of 1504 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 1504 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 1884 wrote to memory of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 1884 wrote to memory of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 1884 wrote to memory of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 1884 wrote to memory of 5040 1884 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe PID 5040 wrote to memory of 4456 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe explorer.exe PID 5040 wrote to memory of 4456 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe explorer.exe PID 5040 wrote to memory of 4456 5040 045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe explorer.exe PID 4456 wrote to memory of 208 4456 explorer.exe explorer.exe PID 4456 wrote to memory of 208 4456 explorer.exe explorer.exe PID 4456 wrote to memory of 208 4456 explorer.exe explorer.exe PID 4456 wrote to memory of 208 4456 explorer.exe explorer.exe PID 4456 wrote to memory of 208 4456 explorer.exe explorer.exe PID 208 wrote to memory of 4144 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4144 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4144 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4752 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4752 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4752 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1272 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1272 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1272 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1864 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1864 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1864 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1220 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1220 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1220 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3344 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3344 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3344 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3244 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3244 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3244 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1236 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1236 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1236 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 404 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 404 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 404 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3476 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3476 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3476 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3896 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3896 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3896 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2020 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2020 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2020 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2560 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2560 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 2560 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 5052 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 5052 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 5052 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4652 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4652 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 4652 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3036 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3036 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 3036 208 explorer.exe spoolsv.exe PID 208 wrote to memory of 1924 208 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045ebb38c3f6d258560735db9e7291bd_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD53d541adfc685b5aa61ea848adbadccd5
SHA15cd0f7c6fcf6791509bfbe864cfa2c9cb5475d2e
SHA25635cdc9f9a37d62df4af1af81ea896c0f99232f7e3ccb168e42927b1b72d28005
SHA5123e6a4a7c11d70f9939dfb0afa278e5ea01c734e5253e501cafff33d56c5916609aab9b8c5950460cac137f6ca383c1b856b4d60aa404c74076ad3dc33b020039
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5d2972d5915e2ed982a8465c8baa1ea38
SHA17cae12054244fb8b76344a9f9c2d6533f1508bdf
SHA256c09b9a2d5b5d00dde5190487bfaf29d5831efec43d60a4446430009724b8d217
SHA512ae39a4506d80b90e16a27f71a1509ab1b527aaf3dca34a941822ce64335a1d88bf1e559b25134869f7eee130c54b1fed7b7e84f71edf90678bb6e5ebbfd980fa
-
memory/208-70-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/208-1010-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/212-2693-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/212-2468-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/216-2704-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/404-1654-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/448-2726-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/532-5674-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/532-5490-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/536-2738-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/612-2376-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/664-2477-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/740-3144-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/748-4239-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/816-2748-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/848-2682-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1124-2375-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1220-1270-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1236-1463-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1272-1268-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1340-5045-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1356-2990-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1520-3274-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1520-3270-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1720-3153-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1752-3135-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1768-2500-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1864-1269-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1884-21-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1884-23-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/1884-0-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/1884-27-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1924-2017-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1972-5761-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1980-3352-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2020-1657-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2040-4764-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2072-2718-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2388-2018-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2404-6086-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2456-5943-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2540-3372-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2560-1841-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2608-2274-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2684-2947-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2800-5417-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2820-4615-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2916-2273-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2952-2852-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-5995-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-5932-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3036-2016-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3132-2757-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3244-1462-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3264-5336-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3308-2979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3308-2975-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3328-2275-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3344-1461-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3396-4032-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3476-1655-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3480-5509-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3504-5034-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3504-5178-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3568-3166-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3568-3161-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3644-2364-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3740-2575-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3740-2366-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3852-3361-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3896-1656-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3920-5781-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3944-2594-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3944-2922-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4036-2488-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4036-2492-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4040-2365-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4056-3390-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4056-5519-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4144-2361-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4144-1011-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4164-2960-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4164-2956-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4264-2467-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4340-5606-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4340-5611-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4372-3850-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4456-71-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4456-65-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4508-2374-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4652-1843-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4660-3343-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4732-3602-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4732-3684-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4752-2377-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4752-1012-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4800-2512-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4964-4332-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5040-54-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5040-52-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/5040-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5040-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5052-1842-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5100-3043-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5100-2939-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB