Analysis
-
max time kernel
147s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 05:49
Behavioral task
behavioral1
Sample
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
048152d3b59f3b874a330b1bda406ee5
-
SHA1
474843ee2c56f47f86299a6cf88262ad3c9c49af
-
SHA256
d081754846bcf93a1364b1d94665929bfd53e139e7660f31c3321aa9da3d544d
-
SHA512
83db4e26882d9008ce0734c8cca5ebed386f96006639ee2582e3178170b8fa1e4e88c8906afa50526dcf4aeb995280252b705e5fcd001d338d2057db13d071c7
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwT
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 968 explorer.exe 4028 explorer.exe 1260 spoolsv.exe 1780 spoolsv.exe 3356 spoolsv.exe 4216 spoolsv.exe 3348 spoolsv.exe 4316 spoolsv.exe 2184 spoolsv.exe 4332 spoolsv.exe 2016 spoolsv.exe 4908 spoolsv.exe 2324 spoolsv.exe 4896 spoolsv.exe 4060 spoolsv.exe 4444 spoolsv.exe 3880 spoolsv.exe 1628 spoolsv.exe 3192 spoolsv.exe 2828 spoolsv.exe 3160 spoolsv.exe 3112 spoolsv.exe 5080 spoolsv.exe 1624 spoolsv.exe 2144 spoolsv.exe 2492 spoolsv.exe 3124 spoolsv.exe 4416 spoolsv.exe 4784 spoolsv.exe 4536 spoolsv.exe 2652 spoolsv.exe 320 spoolsv.exe 4192 explorer.exe 3080 spoolsv.exe 3756 spoolsv.exe 2332 spoolsv.exe 3708 spoolsv.exe 2980 spoolsv.exe 624 spoolsv.exe 3780 spoolsv.exe 1396 explorer.exe 5108 spoolsv.exe 1012 spoolsv.exe 1580 spoolsv.exe 4000 spoolsv.exe 3576 spoolsv.exe 4608 spoolsv.exe 1760 explorer.exe 2312 spoolsv.exe 400 spoolsv.exe 2880 spoolsv.exe 1944 spoolsv.exe 3224 spoolsv.exe 4472 spoolsv.exe 556 spoolsv.exe 4852 spoolsv.exe 3120 explorer.exe 3960 spoolsv.exe 4228 spoolsv.exe 4188 spoolsv.exe 4868 spoolsv.exe 2808 spoolsv.exe 868 explorer.exe 4808 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
Processes:
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 4660 set thread context of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 968 set thread context of 4028 968 explorer.exe explorer.exe PID 1260 set thread context of 320 1260 spoolsv.exe spoolsv.exe PID 1780 set thread context of 3080 1780 spoolsv.exe spoolsv.exe PID 3356 set thread context of 3756 3356 spoolsv.exe spoolsv.exe PID 4216 set thread context of 2332 4216 spoolsv.exe spoolsv.exe PID 3348 set thread context of 2980 3348 spoolsv.exe spoolsv.exe PID 4316 set thread context of 624 4316 spoolsv.exe spoolsv.exe PID 2184 set thread context of 3780 2184 spoolsv.exe spoolsv.exe PID 4332 set thread context of 5108 4332 spoolsv.exe spoolsv.exe PID 2016 set thread context of 1012 2016 spoolsv.exe spoolsv.exe PID 4908 set thread context of 4000 4908 spoolsv.exe spoolsv.exe PID 2324 set thread context of 3576 2324 spoolsv.exe spoolsv.exe PID 4896 set thread context of 4608 4896 spoolsv.exe spoolsv.exe PID 4060 set thread context of 2312 4060 spoolsv.exe spoolsv.exe PID 4444 set thread context of 2880 4444 spoolsv.exe spoolsv.exe PID 3880 set thread context of 1944 3880 spoolsv.exe spoolsv.exe PID 1628 set thread context of 3224 1628 spoolsv.exe spoolsv.exe PID 3192 set thread context of 4472 3192 spoolsv.exe spoolsv.exe PID 2828 set thread context of 4852 2828 spoolsv.exe spoolsv.exe PID 3160 set thread context of 3960 3160 spoolsv.exe spoolsv.exe PID 3112 set thread context of 4228 3112 spoolsv.exe spoolsv.exe PID 5080 set thread context of 4188 5080 spoolsv.exe spoolsv.exe PID 1624 set thread context of 2808 1624 spoolsv.exe spoolsv.exe PID 2144 set thread context of 4808 2144 spoolsv.exe spoolsv.exe PID 2492 set thread context of 3836 2492 spoolsv.exe spoolsv.exe PID 3124 set thread context of 1520 3124 spoolsv.exe spoolsv.exe PID 4416 set thread context of 1572 4416 spoolsv.exe spoolsv.exe PID 4784 set thread context of 3092 4784 spoolsv.exe spoolsv.exe PID 4536 set thread context of 5028 4536 spoolsv.exe spoolsv.exe PID 2652 set thread context of 3640 2652 spoolsv.exe spoolsv.exe PID 4192 set thread context of 2188 4192 explorer.exe explorer.exe PID 3708 set thread context of 4152 3708 spoolsv.exe spoolsv.exe PID 1396 set thread context of 3164 1396 explorer.exe explorer.exe PID 1580 set thread context of 1116 1580 spoolsv.exe spoolsv.exe PID 1760 set thread context of 968 1760 explorer.exe explorer.exe PID 400 set thread context of 4364 400 spoolsv.exe spoolsv.exe PID 556 set thread context of 1636 556 spoolsv.exe spoolsv.exe PID 3120 set thread context of 3000 3120 explorer.exe explorer.exe PID 4868 set thread context of 4892 4868 spoolsv.exe spoolsv.exe PID 868 set thread context of 4284 868 explorer.exe explorer.exe PID 4504 set thread context of 3776 4504 spoolsv.exe spoolsv.exe PID 4412 set thread context of 4344 4412 explorer.exe explorer.exe PID 2172 set thread context of 4788 2172 spoolsv.exe spoolsv.exe PID 2408 set thread context of 840 2408 spoolsv.exe spoolsv.exe PID 4448 set thread context of 3712 4448 spoolsv.exe spoolsv.exe PID 2240 set thread context of 2388 2240 explorer.exe explorer.exe PID 2204 set thread context of 2456 2204 spoolsv.exe spoolsv.exe PID 4900 set thread context of 2780 4900 spoolsv.exe spoolsv.exe PID 3116 set thread context of 4800 3116 spoolsv.exe spoolsv.exe PID 3744 set thread context of 1872 3744 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exeexplorer.exepid process 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4028 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 4028 explorer.exe 320 spoolsv.exe 320 spoolsv.exe 3080 spoolsv.exe 3080 spoolsv.exe 3756 spoolsv.exe 3756 spoolsv.exe 2332 spoolsv.exe 2332 spoolsv.exe 2980 spoolsv.exe 2980 spoolsv.exe 624 spoolsv.exe 624 spoolsv.exe 3780 spoolsv.exe 3780 spoolsv.exe 5108 spoolsv.exe 5108 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 4000 spoolsv.exe 4000 spoolsv.exe 3576 spoolsv.exe 3576 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 2312 spoolsv.exe 2312 spoolsv.exe 2880 spoolsv.exe 2880 spoolsv.exe 1944 spoolsv.exe 1944 spoolsv.exe 3224 spoolsv.exe 3224 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 4852 spoolsv.exe 4852 spoolsv.exe 3960 spoolsv.exe 3960 spoolsv.exe 4228 spoolsv.exe 4228 spoolsv.exe 4188 spoolsv.exe 4188 spoolsv.exe 2808 spoolsv.exe 2808 spoolsv.exe 4808 spoolsv.exe 4808 spoolsv.exe 3836 spoolsv.exe 3836 spoolsv.exe 1520 spoolsv.exe 1520 spoolsv.exe 1572 spoolsv.exe 1572 spoolsv.exe 3092 spoolsv.exe 3092 spoolsv.exe 5028 spoolsv.exe 5028 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4660 wrote to memory of 3704 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe splwow64.exe PID 4660 wrote to memory of 3704 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe splwow64.exe PID 4660 wrote to memory of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 4660 wrote to memory of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 4660 wrote to memory of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 4660 wrote to memory of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 4660 wrote to memory of 3472 4660 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe PID 3472 wrote to memory of 968 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe explorer.exe PID 3472 wrote to memory of 968 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe explorer.exe PID 3472 wrote to memory of 968 3472 048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe explorer.exe PID 968 wrote to memory of 4028 968 explorer.exe explorer.exe PID 968 wrote to memory of 4028 968 explorer.exe explorer.exe PID 968 wrote to memory of 4028 968 explorer.exe explorer.exe PID 968 wrote to memory of 4028 968 explorer.exe explorer.exe PID 968 wrote to memory of 4028 968 explorer.exe explorer.exe PID 4028 wrote to memory of 1260 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1260 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1260 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1780 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1780 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1780 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3356 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3356 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3356 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4216 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4216 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4216 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3348 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3348 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3348 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4316 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4316 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4316 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2184 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2184 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2184 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4332 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4332 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4332 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2016 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2016 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2016 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4908 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4908 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4908 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2324 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2324 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 2324 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4896 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4896 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4896 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4060 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4060 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4060 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4444 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4444 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 4444 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3880 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3880 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3880 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1628 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1628 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 1628 4028 explorer.exe spoolsv.exe PID 4028 wrote to memory of 3192 4028 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\048152d3b59f3b874a330b1bda406ee5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD54c9f265d787da6c770287b32e11e535f
SHA168d31dbd5fdc5b07d5b6b82929b0aab532a6cf8c
SHA2565e21c06731f11b291a649e99f216d5f82d7cdf1a6eae483f1482bb958c6f38b7
SHA512494f83ad83b395e996a07555a1780e88ee64295c228cfc04cab0dea1352875e3657aca00cdef326e628a400a3e3eb2c22daf0c277c05eb73073c9f6663c92ad4
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5c36640c1e5dcd84d9ca717345335a0b2
SHA1c87cb80dd3a31e84bb0ab5777ce0a502f1a7cc77
SHA256af2da9e0d1a17b05ac97a3f40fcd0bdd49c556f2aff73c43a513d8810a801e4c
SHA512cff318e7396714c5aa7ec32cf5c05795ec37826bc06ee7e2c2cdc4b786faba9bdd5f05ef7ebe85e1899b1e42160e6aee3fd8d14fed8afc0c6f3e3f7fc37d956d
-
memory/320-1895-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-2036-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/968-91-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/968-3958-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/968-86-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1012-2142-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1116-3753-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1116-3883-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1260-861-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1260-1896-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1520-2902-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1572-2818-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1624-1925-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1628-1819-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1636-4330-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1636-4214-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1780-992-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1780-1907-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1872-5009-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1944-2388-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2016-1364-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2124-5050-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2124-5046-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2184-1362-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2188-3290-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2312-2314-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2312-2318-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2324-1488-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2332-1926-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2388-4762-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2780-4849-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2780-4844-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2808-2710-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2828-1892-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2880-2376-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2880-2378-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2980-2026-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3000-4223-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3080-1906-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3092-2829-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3112-1905-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3160-1894-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3164-3616-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3192-1825-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3224-2395-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3348-1160-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3356-1918-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3356-993-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3472-27-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3472-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3472-73-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/3472-75-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3576-2230-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3640-3197-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3640-3059-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3712-4751-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3756-1917-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3776-4721-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3776-4593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3780-2274-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3780-2124-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3880-1818-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3960-2553-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4000-2219-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4028-860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4028-90-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4060-1654-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4152-3528-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4152-3435-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4188-2574-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4216-994-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4216-1927-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4228-2562-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4284-4405-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4316-1161-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4332-1363-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4344-4599-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4364-4136-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4364-4038-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4444-1655-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4608-2456-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-2308-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4644-5031-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4660-21-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4660-0-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4660-23-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4660-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4800-4858-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4808-2718-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4852-2544-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4852-2687-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4892-4406-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4896-1489-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4908-1487-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4932-5038-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5028-2857-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5028-2865-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5080-1916-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5108-2133-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB