Analysis
-
max time kernel
147s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:19
Behavioral task
behavioral1
Sample
045c090c1b6b382002756431c030b996_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
045c090c1b6b382002756431c030b996_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
045c090c1b6b382002756431c030b996
-
SHA1
1edf3a86a003da0d027ec12b9af404f568d438a4
-
SHA256
5956db3006ceb46223ea16c1cb11d776f794760106551c3f2a562f16fa2631de
-
SHA512
1684f4d812a4c96aad78893b46ccc6851ccd2856f8ff1657e0f038b88ea2a454284d6c86a384a9ca16de22d8c8101f53b7ea8a3b3635641b26c4a69bb042cc7a
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWwwo
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 524 explorer.exe 4692 explorer.exe 1724 spoolsv.exe 2284 spoolsv.exe 4600 spoolsv.exe 3460 spoolsv.exe 3144 spoolsv.exe 3100 spoolsv.exe 5020 spoolsv.exe 1632 spoolsv.exe 2352 spoolsv.exe 2116 spoolsv.exe 3052 spoolsv.exe 2860 spoolsv.exe 2776 spoolsv.exe 2940 spoolsv.exe 1032 spoolsv.exe 1772 spoolsv.exe 3472 spoolsv.exe 4944 spoolsv.exe 5036 spoolsv.exe 3304 spoolsv.exe 4536 spoolsv.exe 3172 spoolsv.exe 4760 spoolsv.exe 4324 spoolsv.exe 760 spoolsv.exe 2440 spoolsv.exe 1992 spoolsv.exe 2700 spoolsv.exe 3124 spoolsv.exe 1384 spoolsv.exe 1028 explorer.exe 4616 spoolsv.exe 1952 spoolsv.exe 1812 spoolsv.exe 4856 spoolsv.exe 4148 explorer.exe 1368 spoolsv.exe 5004 spoolsv.exe 4580 spoolsv.exe 3632 spoolsv.exe 5028 spoolsv.exe 1752 explorer.exe 2616 spoolsv.exe 3876 spoolsv.exe 1604 spoolsv.exe 2180 spoolsv.exe 2524 spoolsv.exe 3400 spoolsv.exe 4412 explorer.exe 2704 spoolsv.exe 4256 spoolsv.exe 3008 spoolsv.exe 4348 spoolsv.exe 4848 spoolsv.exe 1524 explorer.exe 4512 spoolsv.exe 4340 spoolsv.exe 4700 spoolsv.exe 3584 spoolsv.exe 3336 spoolsv.exe 3612 spoolsv.exe 4140 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 53 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 4296 set thread context of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 524 set thread context of 4692 524 explorer.exe explorer.exe PID 1724 set thread context of 1384 1724 spoolsv.exe spoolsv.exe PID 2284 set thread context of 4616 2284 spoolsv.exe spoolsv.exe PID 4600 set thread context of 1812 4600 spoolsv.exe spoolsv.exe PID 3460 set thread context of 4856 3460 spoolsv.exe spoolsv.exe PID 3144 set thread context of 1368 3144 spoolsv.exe spoolsv.exe PID 3100 set thread context of 5004 3100 spoolsv.exe spoolsv.exe PID 5020 set thread context of 4580 5020 spoolsv.exe spoolsv.exe PID 1632 set thread context of 5028 1632 spoolsv.exe spoolsv.exe PID 2352 set thread context of 2616 2352 spoolsv.exe spoolsv.exe PID 2116 set thread context of 3876 2116 spoolsv.exe spoolsv.exe PID 3052 set thread context of 1604 3052 spoolsv.exe spoolsv.exe PID 2860 set thread context of 2180 2860 spoolsv.exe spoolsv.exe PID 2776 set thread context of 3400 2776 spoolsv.exe spoolsv.exe PID 2940 set thread context of 2704 2940 spoolsv.exe spoolsv.exe PID 1032 set thread context of 4256 1032 spoolsv.exe spoolsv.exe PID 1772 set thread context of 4348 1772 spoolsv.exe spoolsv.exe PID 3472 set thread context of 4848 3472 spoolsv.exe spoolsv.exe PID 4944 set thread context of 4512 4944 spoolsv.exe spoolsv.exe PID 5036 set thread context of 4340 5036 spoolsv.exe spoolsv.exe PID 3304 set thread context of 4700 3304 spoolsv.exe spoolsv.exe PID 4536 set thread context of 3584 4536 spoolsv.exe spoolsv.exe PID 3172 set thread context of 3612 3172 spoolsv.exe spoolsv.exe PID 4760 set thread context of 4140 4760 spoolsv.exe spoolsv.exe PID 4324 set thread context of 2184 4324 spoolsv.exe spoolsv.exe PID 760 set thread context of 4064 760 spoolsv.exe spoolsv.exe PID 2440 set thread context of 3636 2440 spoolsv.exe spoolsv.exe PID 1992 set thread context of 3416 1992 spoolsv.exe spoolsv.exe PID 2700 set thread context of 4920 2700 spoolsv.exe spoolsv.exe PID 3124 set thread context of 2424 3124 spoolsv.exe spoolsv.exe PID 1028 set thread context of 3428 1028 explorer.exe explorer.exe PID 1952 set thread context of 2140 1952 spoolsv.exe spoolsv.exe PID 4148 set thread context of 4544 4148 explorer.exe explorer.exe PID 3632 set thread context of 2620 3632 spoolsv.exe spoolsv.exe PID 1752 set thread context of 3428 1752 explorer.exe explorer.exe PID 2524 set thread context of 1020 2524 spoolsv.exe spoolsv.exe PID 4412 set thread context of 4352 4412 explorer.exe explorer.exe PID 3008 set thread context of 1596 3008 spoolsv.exe spoolsv.exe PID 1524 set thread context of 4948 1524 explorer.exe explorer.exe PID 3336 set thread context of 4552 3336 spoolsv.exe spoolsv.exe PID 5048 set thread context of 3176 5048 explorer.exe explorer.exe PID 2272 set thread context of 5052 2272 spoolsv.exe spoolsv.exe PID 1008 set thread context of 4896 1008 explorer.exe explorer.exe PID 1888 set thread context of 624 1888 spoolsv.exe spoolsv.exe PID 3932 set thread context of 3840 3932 spoolsv.exe spoolsv.exe PID 2944 set thread context of 2016 2944 explorer.exe explorer.exe PID 3700 set thread context of 3812 3700 spoolsv.exe spoolsv.exe PID 3884 set thread context of 3436 3884 spoolsv.exe spoolsv.exe PID 4612 set thread context of 2996 4612 spoolsv.exe spoolsv.exe PID 4360 set thread context of 2696 4360 explorer.exe explorer.exe PID 2936 set thread context of 3012 2936 spoolsv.exe spoolsv.exe PID 524 set thread context of 4720 524 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe045c090c1b6b382002756431c030b996_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini 045c090c1b6b382002756431c030b996_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exeexplorer.exepid process 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4692 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 1384 spoolsv.exe 1384 spoolsv.exe 4616 spoolsv.exe 4616 spoolsv.exe 1812 spoolsv.exe 1812 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 1368 spoolsv.exe 1368 spoolsv.exe 5004 spoolsv.exe 5004 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 5028 spoolsv.exe 5028 spoolsv.exe 2616 spoolsv.exe 2616 spoolsv.exe 3876 spoolsv.exe 3876 spoolsv.exe 1604 spoolsv.exe 1604 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 3400 spoolsv.exe 3400 spoolsv.exe 2704 spoolsv.exe 2704 spoolsv.exe 4256 spoolsv.exe 4256 spoolsv.exe 4348 spoolsv.exe 4348 spoolsv.exe 4848 spoolsv.exe 4848 spoolsv.exe 4512 spoolsv.exe 4512 spoolsv.exe 4340 spoolsv.exe 4340 spoolsv.exe 4700 spoolsv.exe 4700 spoolsv.exe 3584 spoolsv.exe 3584 spoolsv.exe 3612 spoolsv.exe 3612 spoolsv.exe 4140 spoolsv.exe 4140 spoolsv.exe 2184 spoolsv.exe 2184 spoolsv.exe 4064 spoolsv.exe 4064 spoolsv.exe 3636 spoolsv.exe 3636 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 4920 spoolsv.exe 4920 spoolsv.exe 2424 spoolsv.exe 2424 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
045c090c1b6b382002756431c030b996_JaffaCakes118.exe045c090c1b6b382002756431c030b996_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4296 wrote to memory of 3684 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe splwow64.exe PID 4296 wrote to memory of 3684 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe splwow64.exe PID 4296 wrote to memory of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 4296 wrote to memory of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 4296 wrote to memory of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 4296 wrote to memory of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 4296 wrote to memory of 4844 4296 045c090c1b6b382002756431c030b996_JaffaCakes118.exe 045c090c1b6b382002756431c030b996_JaffaCakes118.exe PID 4844 wrote to memory of 524 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe explorer.exe PID 4844 wrote to memory of 524 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe explorer.exe PID 4844 wrote to memory of 524 4844 045c090c1b6b382002756431c030b996_JaffaCakes118.exe explorer.exe PID 524 wrote to memory of 4692 524 explorer.exe explorer.exe PID 524 wrote to memory of 4692 524 explorer.exe explorer.exe PID 524 wrote to memory of 4692 524 explorer.exe explorer.exe PID 524 wrote to memory of 4692 524 explorer.exe explorer.exe PID 524 wrote to memory of 4692 524 explorer.exe explorer.exe PID 4692 wrote to memory of 1724 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1724 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1724 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2284 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2284 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2284 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 4600 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 4600 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 4600 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3460 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3460 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3460 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3144 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3144 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3144 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3100 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3100 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3100 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 5020 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 5020 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 5020 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1632 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1632 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1632 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2352 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2352 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2352 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2116 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2116 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2116 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3052 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3052 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3052 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2860 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2860 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2860 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2776 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2776 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2776 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2940 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2940 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 2940 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1032 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1032 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1032 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1772 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1772 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 1772 4692 explorer.exe spoolsv.exe PID 4692 wrote to memory of 3472 4692 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045c090c1b6b382002756431c030b996_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045c090c1b6b382002756431c030b996_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\045c090c1b6b382002756431c030b996_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045c090c1b6b382002756431c030b996_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD50eec8ae5603d433e461c460edf7601c3
SHA13b7a0d517b0e8709c9ea3cd410d4a715898cb1b5
SHA2561d60d4a1c600f017b40c9c7a98f2514385a11c5fb6a72bb5a7dd16c11b981ee3
SHA512c1b89aa322c558e23883562270e4f19b4e00c26a1f1a29c4092d9c1108d4b6723594d0aa7c727e069b84261ad5ff4afdc1cf1d88fba0db67a4b151b33780f542
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD51805f418ef49efa235ee7de47c34ebb7
SHA184f7458249621c8e0c3456f8b339c8f9e3954a12
SHA2569c12cf4939848c61ca51997f96381632d9e076a2fc5a0da3751614c48e75f630
SHA5122ab5d4f0203cade358189d3e3692c5aca7134cedaa57a53ea09b5093aec4412a1824af9715cb30bc15ba6e9b617996613703a49522b4ae0fcb39c15340c298a8
-
memory/524-83-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/524-78-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1020-3898-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1020-3961-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1032-1617-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1368-2080-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1384-2053-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1384-1881-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1596-4167-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1596-4287-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1604-2302-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1632-1295-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1724-1882-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1724-803-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1768-5164-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1772-1800-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1812-1983-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2016-4824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2116-1479-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2140-3384-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2140-3493-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-2313-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-2316-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2184-2824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2284-959-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2284-1893-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2352-1296-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2424-3120-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2424-3247-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2616-2283-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2620-3630-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2696-5028-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2704-2470-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2704-2473-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2776-1615-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2860-1481-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2940-1616-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2996-5111-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2996-4979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3012-5045-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3052-1480-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3100-1098-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3144-1097-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3176-4531-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3304-1892-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3400-2627-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3400-2461-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3428-3660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3428-3200-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3436-4851-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3436-4860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3460-2064-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3460-961-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3472-1801-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3584-2681-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3612-2794-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3636-2907-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3812-4833-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3840-4814-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3876-2291-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4064-2897-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-2814-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-2963-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4256-2485-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-0-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/4296-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4296-32-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4296-28-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/4340-2663-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4348-2553-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4352-3909-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4352-3906-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4536-1982-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4544-3393-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4552-4382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4552-4501-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4580-2110-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4600-1985-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4600-960-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4616-1890-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4616-1888-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4692-802-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4692-82-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4720-5058-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4844-72-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4844-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4844-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4848-2646-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4848-2792-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4856-2240-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4856-2067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4896-4624-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4920-3044-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4944-1879-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4948-4176-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4948-4179-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5004-2090-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5020-1294-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5036-1880-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5052-4738-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5052-4608-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB