Analysis
-
max time kernel
128s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 07:26
Behavioral task
behavioral1
Sample
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
04ab99ea234267d183fb05a49c03eba5
-
SHA1
abed32fcca4c4c588079eac8248ae129716f8982
-
SHA256
2ef94e39c8100961490786a6a8b89237957fe350edca895ffe340e5fff261cb4
-
SHA512
b4d806c828b0bacfacaa7447fe6aeb85a795b33ddb334d8fcd28330e2ef8762b241b67c30f29f6d22cc034b1c3702766a6b1450af4600f7622c42e40c7edd89d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWwwO
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1872 explorer.exe 5076 explorer.exe 1448 spoolsv.exe 2052 spoolsv.exe 1712 spoolsv.exe 4404 spoolsv.exe 4928 spoolsv.exe 4016 spoolsv.exe 2468 spoolsv.exe 4500 spoolsv.exe 3020 spoolsv.exe 1344 spoolsv.exe 556 spoolsv.exe 4336 spoolsv.exe 748 spoolsv.exe 4504 spoolsv.exe 1988 spoolsv.exe 1888 spoolsv.exe 3008 spoolsv.exe 2352 spoolsv.exe 4060 spoolsv.exe 1512 spoolsv.exe 4152 spoolsv.exe 384 spoolsv.exe 4816 spoolsv.exe 5056 spoolsv.exe 2448 spoolsv.exe 2184 spoolsv.exe 3528 spoolsv.exe 2732 spoolsv.exe 944 spoolsv.exe 4544 spoolsv.exe 3148 spoolsv.exe 5100 explorer.exe 3408 spoolsv.exe 1576 spoolsv.exe 1792 spoolsv.exe 4288 spoolsv.exe 2988 spoolsv.exe 4724 spoolsv.exe 3488 explorer.exe 5012 spoolsv.exe 4900 spoolsv.exe 1192 spoolsv.exe 4460 spoolsv.exe 4452 spoolsv.exe 1276 spoolsv.exe 1640 explorer.exe 1076 spoolsv.exe 1552 spoolsv.exe 4456 spoolsv.exe 5032 spoolsv.exe 3744 explorer.exe 1908 spoolsv.exe 3520 spoolsv.exe 2972 spoolsv.exe 4056 spoolsv.exe 4608 spoolsv.exe 3580 spoolsv.exe 1132 explorer.exe 1616 spoolsv.exe 3384 spoolsv.exe 1384 spoolsv.exe 3892 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 40 IoCs
Processes:
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 212 set thread context of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 1872 set thread context of 5076 1872 explorer.exe explorer.exe PID 1448 set thread context of 3148 1448 spoolsv.exe spoolsv.exe PID 2052 set thread context of 3408 2052 spoolsv.exe spoolsv.exe PID 1712 set thread context of 1576 1712 spoolsv.exe spoolsv.exe PID 4404 set thread context of 1792 4404 spoolsv.exe spoolsv.exe PID 4928 set thread context of 4288 4928 spoolsv.exe spoolsv.exe PID 4016 set thread context of 4724 4016 spoolsv.exe spoolsv.exe PID 2468 set thread context of 5012 2468 spoolsv.exe spoolsv.exe PID 4500 set thread context of 4900 4500 spoolsv.exe spoolsv.exe PID 3020 set thread context of 1192 3020 spoolsv.exe spoolsv.exe PID 1344 set thread context of 4452 1344 spoolsv.exe spoolsv.exe PID 556 set thread context of 1276 556 spoolsv.exe spoolsv.exe PID 4336 set thread context of 1076 4336 spoolsv.exe spoolsv.exe PID 748 set thread context of 4456 748 spoolsv.exe spoolsv.exe PID 4504 set thread context of 5032 4504 spoolsv.exe spoolsv.exe PID 1988 set thread context of 1908 1988 spoolsv.exe spoolsv.exe PID 1888 set thread context of 3520 1888 spoolsv.exe spoolsv.exe PID 3008 set thread context of 4056 3008 spoolsv.exe spoolsv.exe PID 2352 set thread context of 4608 2352 spoolsv.exe spoolsv.exe PID 4060 set thread context of 3580 4060 spoolsv.exe spoolsv.exe PID 1512 set thread context of 3384 1512 spoolsv.exe spoolsv.exe PID 4152 set thread context of 1384 4152 spoolsv.exe spoolsv.exe PID 384 set thread context of 3892 384 spoolsv.exe spoolsv.exe PID 4816 set thread context of 1008 4816 spoolsv.exe spoolsv.exe PID 5056 set thread context of 5060 5056 spoolsv.exe spoolsv.exe PID 2448 set thread context of 2656 2448 spoolsv.exe spoolsv.exe PID 2184 set thread context of 2280 2184 spoolsv.exe spoolsv.exe PID 3528 set thread context of 1596 3528 spoolsv.exe spoolsv.exe PID 2732 set thread context of 4376 2732 spoolsv.exe spoolsv.exe PID 944 set thread context of 4564 944 spoolsv.exe spoolsv.exe PID 4544 set thread context of 2904 4544 spoolsv.exe spoolsv.exe PID 5100 set thread context of 1244 5100 explorer.exe explorer.exe PID 3488 set thread context of 5052 3488 explorer.exe explorer.exe PID 2988 set thread context of 3480 2988 spoolsv.exe spoolsv.exe PID 4460 set thread context of 3816 4460 spoolsv.exe spoolsv.exe PID 1640 set thread context of 4140 1640 explorer.exe explorer.exe PID 1552 set thread context of 4728 1552 spoolsv.exe spoolsv.exe PID 3744 set thread context of 1452 3744 explorer.exe explorer.exe PID 2972 set thread context of 516 2972 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exeexplorer.exepid process 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 5076 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 3148 spoolsv.exe 3148 spoolsv.exe 3408 spoolsv.exe 3408 spoolsv.exe 1576 spoolsv.exe 1576 spoolsv.exe 1792 spoolsv.exe 1792 spoolsv.exe 4288 spoolsv.exe 4288 spoolsv.exe 4724 spoolsv.exe 4724 spoolsv.exe 5012 spoolsv.exe 5012 spoolsv.exe 4900 spoolsv.exe 4900 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 4452 spoolsv.exe 4452 spoolsv.exe 1276 spoolsv.exe 1276 spoolsv.exe 1076 spoolsv.exe 1076 spoolsv.exe 4456 spoolsv.exe 4456 spoolsv.exe 5032 spoolsv.exe 5032 spoolsv.exe 1908 spoolsv.exe 1908 spoolsv.exe 3520 spoolsv.exe 3520 spoolsv.exe 4056 spoolsv.exe 4056 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 3384 spoolsv.exe 3384 spoolsv.exe 1384 spoolsv.exe 1384 spoolsv.exe 3892 spoolsv.exe 3892 spoolsv.exe 1008 spoolsv.exe 1008 spoolsv.exe 5060 spoolsv.exe 5060 spoolsv.exe 2656 spoolsv.exe 2656 spoolsv.exe 2280 spoolsv.exe 2280 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 4376 spoolsv.exe 4376 spoolsv.exe 4564 spoolsv.exe 4564 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 212 wrote to memory of 2036 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe splwow64.exe PID 212 wrote to memory of 2036 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe splwow64.exe PID 212 wrote to memory of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 212 wrote to memory of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 212 wrote to memory of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 212 wrote to memory of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 212 wrote to memory of 3764 212 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe PID 3764 wrote to memory of 1872 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe explorer.exe PID 3764 wrote to memory of 1872 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe explorer.exe PID 3764 wrote to memory of 1872 3764 04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe explorer.exe PID 1872 wrote to memory of 5076 1872 explorer.exe explorer.exe PID 1872 wrote to memory of 5076 1872 explorer.exe explorer.exe PID 1872 wrote to memory of 5076 1872 explorer.exe explorer.exe PID 1872 wrote to memory of 5076 1872 explorer.exe explorer.exe PID 1872 wrote to memory of 5076 1872 explorer.exe explorer.exe PID 5076 wrote to memory of 1448 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1448 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1448 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2052 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2052 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2052 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1712 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1712 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1712 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4404 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4404 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4404 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4928 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4928 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4928 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4016 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4016 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4016 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2468 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2468 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 2468 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4500 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4500 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4500 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 3020 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 3020 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 3020 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1344 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1344 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1344 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 556 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 556 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 556 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4336 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4336 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4336 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 748 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 748 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 748 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4504 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4504 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 4504 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1988 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1988 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1988 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1888 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1888 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 1888 5076 explorer.exe spoolsv.exe PID 5076 wrote to memory of 3008 5076 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04ab99ea234267d183fb05a49c03eba5_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD56f9ce5962a8d61de25e24e54a4418a13
SHA18604b7f7a82d0377442844109676e98069cff4a3
SHA2564ecb211d8b07682819eaf61ef9ea298d361f6fa38386e9e6aef2033977693f63
SHA512930ef330aed62d84cf306bb68be8e3affeaa2533f0cc5f4ec30185158ffaa11430efa685cfa35563ea543244ee30665e3d0f44f49b663112ba605c4d9bcbf9fd
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5527b6337af324146a70f061214380e8b
SHA1344102118165b0bab097340ac3f07d2a54653cc0
SHA256e30ec4d7c7f81dbd43fca75a967e23d1b96eeb6ce03ad884f676ecb833bb0841
SHA512d3dddcac9bcb3d63afa14cf3eed7147b7f2d1f254aaf631f4f8c2e782c582992eea3ece970e9d9b4eac34c17177428e775a70dd0c4d476da1419043f6e01d022
-
memory/212-32-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/212-28-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/212-0-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/212-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/384-1965-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/452-5484-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/516-4375-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/516-4483-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/544-4835-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/556-1428-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/748-1623-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1008-2977-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1008-2837-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1076-2322-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1192-2170-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1244-3520-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1260-4586-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1276-2462-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1276-2311-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1340-5073-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1344-1427-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1384-2743-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1416-5067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1448-750-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1448-1942-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1452-4366-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1512-1946-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1516-5464-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1576-1966-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1576-1967-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/1596-3097-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1708-5265-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1708-5262-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1712-943-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1712-1969-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1792-1979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1860-5014-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1872-80-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1872-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1888-1779-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1908-2487-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1908-2490-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1988-1625-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2052-1954-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2052-942-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2280-3014-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2352-1781-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2468-1127-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2656-2944-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2904-3511-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3008-1780-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3020-1254-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3120-5505-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3148-1947-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3148-2121-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3384-2733-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3408-1957-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3480-3891-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3480-3771-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3496-5092-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3520-2497-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3580-2660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3652-5155-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3652-5013-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3764-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3764-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3764-74-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3816-3962-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3892-2755-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4016-1126-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4056-2572-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4056-2576-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4060-1945-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4140-4083-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-4085-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4152-1956-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4156-5476-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4288-1987-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4336-1429-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4376-3109-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4404-944-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4404-1974-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4452-2278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4452-2257-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4456-2424-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4476-4823-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4500-1253-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4504-1624-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4524-4626-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4564-3331-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-2593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4724-2270-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4724-2140-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4728-4287-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4728-4164-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4816-1972-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4900-2162-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4900-2157-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4928-1125-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4932-5247-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4996-5237-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5012-2150-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5032-2644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5052-3778-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-2933-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5076-84-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5076-749-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB