Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:50
Behavioral task
behavioral1
Sample
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
044f1beba281129bb335c7d87311a468
-
SHA1
ea8cef33799449e83c4af412dc52205b9b86a97f
-
SHA256
961f04770851408277e71fb089899c210c74d6a768aaf21f9ba23175fd0e8ef1
-
SHA512
ba10b8a2f0d41eefd1de0cd61ee73c9e111565374c55b8997d6e0f308bcc9a90f25c4bcf44da32949da21dd512c57bb6eac7166a388db515c9df4c9ad754eaed
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwi
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exepid process 3216 explorer.exe 2880 explorer.exe 5100 spoolsv.exe 1964 spoolsv.exe 2432 spoolsv.exe 3596 spoolsv.exe 2584 spoolsv.exe 4992 spoolsv.exe 3232 spoolsv.exe 4732 spoolsv.exe 4416 spoolsv.exe 4168 spoolsv.exe 840 spoolsv.exe 4444 spoolsv.exe 2128 spoolsv.exe 2976 spoolsv.exe 4768 spoolsv.exe 3076 spoolsv.exe 2332 spoolsv.exe 3168 spoolsv.exe 1564 spoolsv.exe 1272 spoolsv.exe 3432 spoolsv.exe 684 spoolsv.exe 4748 spoolsv.exe 5032 spoolsv.exe 2156 spoolsv.exe 3112 spoolsv.exe 228 spoolsv.exe 3620 spoolsv.exe 4068 spoolsv.exe 5112 spoolsv.exe 2876 spoolsv.exe 3960 explorer.exe 1160 spoolsv.exe 3632 spoolsv.exe 2368 spoolsv.exe 2924 spoolsv.exe 1776 spoolsv.exe 224 explorer.exe 624 spoolsv.exe 660 spoolsv.exe 3408 spoolsv.exe 2148 spoolsv.exe 5048 spoolsv.exe 1628 spoolsv.exe 2316 spoolsv.exe 4644 explorer.exe 464 spoolsv.exe 2480 spoolsv.exe 2508 spoolsv.exe 4388 spoolsv.exe 664 explorer.exe 4672 spoolsv.exe 2324 spoolsv.exe 4880 spoolsv.exe 2180 spoolsv.exe 1408 spoolsv.exe 4572 spoolsv.exe 944 spoolsv.exe 1164 explorer.exe 4268 spoolsv.exe 2060 spoolsv.exe 4316 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1088 set thread context of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 3216 set thread context of 2880 3216 explorer.exe explorer.exe PID 5100 set thread context of 2876 5100 spoolsv.exe spoolsv.exe PID 1964 set thread context of 1160 1964 spoolsv.exe spoolsv.exe PID 2432 set thread context of 3632 2432 spoolsv.exe spoolsv.exe PID 3596 set thread context of 2368 3596 spoolsv.exe spoolsv.exe PID 2584 set thread context of 1776 2584 spoolsv.exe spoolsv.exe PID 4992 set thread context of 624 4992 spoolsv.exe spoolsv.exe PID 3232 set thread context of 660 3232 spoolsv.exe spoolsv.exe PID 4732 set thread context of 3408 4732 spoolsv.exe spoolsv.exe PID 4416 set thread context of 2148 4416 spoolsv.exe spoolsv.exe PID 4168 set thread context of 5048 4168 spoolsv.exe spoolsv.exe PID 840 set thread context of 2316 840 spoolsv.exe spoolsv.exe PID 4444 set thread context of 464 4444 spoolsv.exe spoolsv.exe PID 2128 set thread context of 2480 2128 spoolsv.exe spoolsv.exe PID 2976 set thread context of 2508 2976 spoolsv.exe spoolsv.exe PID 4768 set thread context of 4388 4768 spoolsv.exe spoolsv.exe PID 3076 set thread context of 2324 3076 spoolsv.exe spoolsv.exe PID 2332 set thread context of 4880 2332 spoolsv.exe spoolsv.exe PID 3168 set thread context of 2180 3168 spoolsv.exe spoolsv.exe PID 1564 set thread context of 1408 1564 spoolsv.exe spoolsv.exe PID 1272 set thread context of 944 1272 spoolsv.exe spoolsv.exe PID 3432 set thread context of 4268 3432 spoolsv.exe spoolsv.exe PID 684 set thread context of 2060 684 spoolsv.exe spoolsv.exe PID 4748 set thread context of 4316 4748 spoolsv.exe spoolsv.exe PID 5032 set thread context of 3688 5032 spoolsv.exe spoolsv.exe PID 2156 set thread context of 2308 2156 spoolsv.exe spoolsv.exe PID 3112 set thread context of 3440 3112 spoolsv.exe spoolsv.exe PID 228 set thread context of 4944 228 spoolsv.exe spoolsv.exe PID 3620 set thread context of 2660 3620 spoolsv.exe spoolsv.exe PID 4068 set thread context of 3656 4068 spoolsv.exe spoolsv.exe PID 5112 set thread context of 3944 5112 spoolsv.exe spoolsv.exe PID 3960 set thread context of 1520 3960 explorer.exe explorer.exe PID 2924 set thread context of 2872 2924 spoolsv.exe spoolsv.exe PID 224 set thread context of 4724 224 explorer.exe explorer.exe PID 4644 set thread context of 3124 4644 explorer.exe explorer.exe PID 1628 set thread context of 1880 1628 spoolsv.exe spoolsv.exe PID 664 set thread context of 1444 664 explorer.exe explorer.exe PID 4672 set thread context of 1092 4672 spoolsv.exe spoolsv.exe PID 1164 set thread context of 212 1164 explorer.exe explorer.exe PID 4572 set thread context of 1208 4572 spoolsv.exe spoolsv.exe PID 4472 set thread context of 3152 4472 spoolsv.exe spoolsv.exe PID 2400 set thread context of 1264 2400 explorer.exe explorer.exe PID 220 set thread context of 768 220 spoolsv.exe spoolsv.exe PID 4740 set thread context of 1260 4740 explorer.exe explorer.exe PID 5108 set thread context of 364 5108 spoolsv.exe spoolsv.exe PID 4284 set thread context of 796 4284 spoolsv.exe spoolsv.exe PID 3140 set thread context of 1156 3140 explorer.exe explorer.exe PID 3600 set thread context of 2908 3600 spoolsv.exe spoolsv.exe PID 4664 set thread context of 4916 4664 spoolsv.exe spoolsv.exe PID 4540 set thread context of 4928 4540 spoolsv.exe spoolsv.exe PID 4088 set thread context of 1524 4088 spoolsv.exe spoolsv.exe PID 3864 set thread context of 2920 3864 explorer.exe explorer.exe PID 4552 set thread context of 1916 4552 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exe044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exepid process 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2880 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2880 explorer.exe 2876 spoolsv.exe 2876 spoolsv.exe 1160 spoolsv.exe 1160 spoolsv.exe 3632 spoolsv.exe 3632 spoolsv.exe 2368 spoolsv.exe 2368 spoolsv.exe 1776 spoolsv.exe 1776 spoolsv.exe 624 spoolsv.exe 624 spoolsv.exe 660 spoolsv.exe 660 spoolsv.exe 3408 spoolsv.exe 3408 spoolsv.exe 2148 spoolsv.exe 2148 spoolsv.exe 5048 spoolsv.exe 5048 spoolsv.exe 2316 spoolsv.exe 2316 spoolsv.exe 464 spoolsv.exe 464 spoolsv.exe 2480 spoolsv.exe 2480 spoolsv.exe 2508 spoolsv.exe 2508 spoolsv.exe 4388 spoolsv.exe 4388 spoolsv.exe 2324 spoolsv.exe 2324 spoolsv.exe 4880 spoolsv.exe 4880 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 1408 spoolsv.exe 1408 spoolsv.exe 944 spoolsv.exe 944 spoolsv.exe 4268 spoolsv.exe 4268 spoolsv.exe 2060 spoolsv.exe 2060 spoolsv.exe 4316 spoolsv.exe 4316 spoolsv.exe 3688 spoolsv.exe 3688 spoolsv.exe 2308 spoolsv.exe 2308 spoolsv.exe 3440 spoolsv.exe 3440 spoolsv.exe 4944 spoolsv.exe 4944 spoolsv.exe 2660 spoolsv.exe 2660 spoolsv.exe 3656 spoolsv.exe 3656 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
044f1beba281129bb335c7d87311a468_JaffaCakes118.exe044f1beba281129bb335c7d87311a468_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1088 wrote to memory of 532 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1088 wrote to memory of 532 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe splwow64.exe PID 1088 wrote to memory of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1088 wrote to memory of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1088 wrote to memory of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1088 wrote to memory of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 1088 wrote to memory of 2836 1088 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe PID 2836 wrote to memory of 3216 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2836 wrote to memory of 3216 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 2836 wrote to memory of 3216 2836 044f1beba281129bb335c7d87311a468_JaffaCakes118.exe explorer.exe PID 3216 wrote to memory of 2880 3216 explorer.exe explorer.exe PID 3216 wrote to memory of 2880 3216 explorer.exe explorer.exe PID 3216 wrote to memory of 2880 3216 explorer.exe explorer.exe PID 3216 wrote to memory of 2880 3216 explorer.exe explorer.exe PID 3216 wrote to memory of 2880 3216 explorer.exe explorer.exe PID 2880 wrote to memory of 5100 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 5100 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 5100 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 1964 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 1964 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 1964 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2432 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2432 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2432 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3596 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3596 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3596 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2584 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2584 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2584 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4992 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4992 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4992 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3232 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3232 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3232 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4732 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4732 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4732 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4416 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4416 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4416 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4168 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4168 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4168 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 840 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 840 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 840 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4444 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4444 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4444 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2128 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2128 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2128 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2976 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2976 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2976 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4768 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4768 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 4768 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3076 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3076 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 3076 2880 explorer.exe spoolsv.exe PID 2880 wrote to memory of 2332 2880 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD53780db0342ed000c2b6c145fc9fd41b5
SHA12b3f75af69cf71500a284849deed6eea4d476443
SHA256761c0d271f56e95c151b6e07b7866bf83e166be16478e06f57227a1ccc0b9756
SHA512ceae4ee69b7703762224d67c53f7f86043187df3cf7007fe26a24b376f0ada65859f81fcf8f6aac603d77020871bbd9ac50782333f3d58d63c0200843810cd56
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD57229273f5c52b691d63768c424c04b55
SHA1f4144a03b07f5e11a7f93c4065dde4453997ec91
SHA2568550f19a477edfae0d6a9a718b56244d6a1ca3bc4032571ede7b5db81d4aaa64
SHA512a53d58bb08e218f2f8eb74fd48a6b897ffed263afaa14a5bd98d1aa7f5b51ca135dd7b353bec52dba8711ea2e76cc6765ac837dd4404253cce2c485b8e4e410b
-
memory/212-4364-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/364-4655-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-2118-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/660-2127-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/684-1954-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/768-4632-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/796-4790-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/796-4975-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/840-1471-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/944-2748-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/944-2654-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1088-0-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/1088-23-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/1088-21-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1088-29-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1092-4162-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1092-4074-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1156-4798-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1160-1944-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1208-4515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1260-4643-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1260-4646-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1264-4624-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1272-1945-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1408-2508-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1444-4067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1520-3226-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1520-3224-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1564-1923-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1776-2110-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1880-3932-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1880-3815-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1916-5061-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1964-1947-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1964-980-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2060-2674-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-2678-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2128-1646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2148-2149-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-2476-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-2480-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2308-2774-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2308-3016-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2316-2256-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2324-2458-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2332-1782-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2368-1985-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2368-1983-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2432-981-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2432-1957-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2508-2282-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2584-1123-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2836-27-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2836-58-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2836-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2876-1924-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2876-2081-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2880-773-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2880-68-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2908-4806-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2920-5055-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-1647-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3076-1781-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3124-3807-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3152-4768-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3152-4614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3168-1922-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3216-69-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3216-64-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3232-1270-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3408-2137-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3408-2140-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3432-1946-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3440-2864-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3596-982-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3632-1955-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3636-5134-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3656-3126-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3656-3033-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3944-3349-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3944-3215-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4168-1470-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4268-2665-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4388-2374-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4388-2558-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4416-1272-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4444-1472-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4724-3560-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4732-1271-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4748-2007-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4768-1648-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4880-2469-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4928-4932-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4944-2874-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4992-1124-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5100-1919-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5100-774-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB