Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 14:39
Behavioral task
behavioral1
Sample
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
056a71d77550b54ed91a2348388b58ce
-
SHA1
fb90dde80eacd6f5a32955f168e6342f1f77e60d
-
SHA256
98b8f94619fb2a3c4fcf069e53b158d019516d75b037185d660cbefc8e0d20ed
-
SHA512
eb6a09a3dcd0edd679ee7aa14c02baf600bb91a4a30ce7ae90ce5932e52b9feec20a85c0ff99173c28f9bc3fba75c4db0dd546a728948c8d2fd1cd79464924f5
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2568 explorer.exe 1940 explorer.exe 3008 spoolsv.exe 1684 spoolsv.exe 2744 spoolsv.exe 1008 spoolsv.exe 2272 spoolsv.exe 2504 spoolsv.exe 2876 spoolsv.exe 2440 spoolsv.exe 1960 spoolsv.exe 2056 spoolsv.exe 1528 spoolsv.exe 1920 spoolsv.exe 1768 spoolsv.exe 2716 spoolsv.exe 2448 spoolsv.exe 2652 spoolsv.exe 872 spoolsv.exe 2016 spoolsv.exe 1672 spoolsv.exe 2216 spoolsv.exe 2484 spoolsv.exe 2796 spoolsv.exe 2632 spoolsv.exe 2120 spoolsv.exe 2732 spoolsv.exe 948 spoolsv.exe 2892 spoolsv.exe 2836 spoolsv.exe 2544 spoolsv.exe 1676 spoolsv.exe 1720 spoolsv.exe 2032 spoolsv.exe 2576 spoolsv.exe 792 spoolsv.exe 1248 spoolsv.exe 432 spoolsv.exe 620 spoolsv.exe 3064 spoolsv.exe 2496 spoolsv.exe 1064 spoolsv.exe 2304 spoolsv.exe 2844 spoolsv.exe 2816 spoolsv.exe 2044 spoolsv.exe 2964 spoolsv.exe 2920 spoolsv.exe 2680 spoolsv.exe 928 spoolsv.exe 2036 spoolsv.exe 3068 spoolsv.exe 472 spoolsv.exe 1600 spoolsv.exe 2492 spoolsv.exe 672 spoolsv.exe 2096 spoolsv.exe 1844 spoolsv.exe 1712 explorer.exe 2292 spoolsv.exe 2916 spoolsv.exe 2244 spoolsv.exe 1484 spoolsv.exe 1932 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exepid process 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2872 set thread context of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2568 set thread context of 1940 2568 explorer.exe explorer.exe PID 3008 set thread context of 1844 3008 spoolsv.exe spoolsv.exe PID 1684 set thread context of 2292 1684 spoolsv.exe spoolsv.exe PID 2744 set thread context of 2916 2744 spoolsv.exe spoolsv.exe PID 1008 set thread context of 2244 1008 spoolsv.exe spoolsv.exe PID 2272 set thread context of 1932 2272 spoolsv.exe spoolsv.exe PID 2504 set thread context of 1612 2504 spoolsv.exe spoolsv.exe PID 2876 set thread context of 956 2876 spoolsv.exe spoolsv.exe PID 2440 set thread context of 3104 2440 spoolsv.exe spoolsv.exe PID 2056 set thread context of 3412 2056 spoolsv.exe spoolsv.exe PID 1960 set thread context of 3596 1960 spoolsv.exe spoolsv.exe PID 1528 set thread context of 3716 1528 spoolsv.exe spoolsv.exe PID 1920 set thread context of 3840 1920 spoolsv.exe spoolsv.exe PID 2716 set thread context of 3932 2716 spoolsv.exe spoolsv.exe PID 872 set thread context of 4012 872 spoolsv.exe spoolsv.exe PID 2448 set thread context of 2080 2448 spoolsv.exe spoolsv.exe PID 2652 set thread context of 1492 2652 spoolsv.exe spoolsv.exe PID 672 set thread context of 3076 672 spoolsv.exe spoolsv.exe PID 2016 set thread context of 3228 2016 spoolsv.exe spoolsv.exe PID 1672 set thread context of 3220 1672 spoolsv.exe spoolsv.exe PID 2484 set thread context of 3232 2484 spoolsv.exe spoolsv.exe PID 2216 set thread context of 3300 2216 spoolsv.exe spoolsv.exe PID 2796 set thread context of 3552 2796 spoolsv.exe spoolsv.exe PID 2732 set thread context of 3576 2732 spoolsv.exe spoolsv.exe PID 2632 set thread context of 3508 2632 spoolsv.exe spoolsv.exe PID 2120 set thread context of 3772 2120 spoolsv.exe spoolsv.exe PID 2892 set thread context of 3740 2892 spoolsv.exe spoolsv.exe PID 948 set thread context of 3752 948 spoolsv.exe spoolsv.exe PID 2836 set thread context of 3788 2836 spoolsv.exe spoolsv.exe PID 1676 set thread context of 3928 1676 spoolsv.exe spoolsv.exe PID 1720 set thread context of 3052 1720 spoolsv.exe spoolsv.exe PID 2544 set thread context of 4028 2544 spoolsv.exe spoolsv.exe PID 2576 set thread context of 1724 2576 spoolsv.exe spoolsv.exe PID 2032 set thread context of 2536 2032 spoolsv.exe spoolsv.exe PID 432 set thread context of 4056 432 spoolsv.exe spoolsv.exe PID 792 set thread context of 4048 792 spoolsv.exe spoolsv.exe PID 620 set thread context of 2872 620 spoolsv.exe spoolsv.exe PID 1248 set thread context of 3272 1248 spoolsv.exe spoolsv.exe PID 3064 set thread context of 1704 3064 spoolsv.exe spoolsv.exe PID 1064 set thread context of 3360 1064 spoolsv.exe spoolsv.exe PID 2304 set thread context of 3468 2304 spoolsv.exe spoolsv.exe PID 2496 set thread context of 2124 2496 spoolsv.exe spoolsv.exe PID 2844 set thread context of 1660 2844 spoolsv.exe spoolsv.exe PID 2920 set thread context of 3480 2920 spoolsv.exe spoolsv.exe PID 2816 set thread context of 2116 2816 spoolsv.exe spoolsv.exe PID 1600 set thread context of 3776 1600 spoolsv.exe spoolsv.exe PID 928 set thread context of 3664 928 spoolsv.exe spoolsv.exe PID 2044 set thread context of 1744 2044 spoolsv.exe spoolsv.exe PID 2036 set thread context of 3816 2036 spoolsv.exe spoolsv.exe PID 3068 set thread context of 3824 3068 spoolsv.exe spoolsv.exe PID 2964 set thread context of 3216 2964 spoolsv.exe spoolsv.exe PID 472 set thread context of 1476 472 spoolsv.exe spoolsv.exe PID 2492 set thread context of 1140 2492 spoolsv.exe spoolsv.exe PID 2680 set thread context of 3876 2680 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exepid process 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1940 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1844 spoolsv.exe 1844 spoolsv.exe 2292 spoolsv.exe 2292 spoolsv.exe 2916 spoolsv.exe 2916 spoolsv.exe 2244 spoolsv.exe 2244 spoolsv.exe 1932 spoolsv.exe 1932 spoolsv.exe 1612 spoolsv.exe 1612 spoolsv.exe 956 spoolsv.exe 956 spoolsv.exe 3104 spoolsv.exe 3104 spoolsv.exe 3412 spoolsv.exe 3412 spoolsv.exe 3596 spoolsv.exe 3596 spoolsv.exe 3716 spoolsv.exe 3716 spoolsv.exe 3840 spoolsv.exe 3840 spoolsv.exe 3932 spoolsv.exe 3932 spoolsv.exe 4004 spoolsv.exe 4004 spoolsv.exe 4012 spoolsv.exe 4012 spoolsv.exe 2080 spoolsv.exe 2080 spoolsv.exe 1492 spoolsv.exe 1492 spoolsv.exe 3076 spoolsv.exe 3076 spoolsv.exe 3228 spoolsv.exe 3228 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 3232 spoolsv.exe 3232 spoolsv.exe 3300 spoolsv.exe 3300 spoolsv.exe 3552 spoolsv.exe 3552 spoolsv.exe 3576 spoolsv.exe 3576 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 3772 spoolsv.exe 3772 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe 3788 spoolsv.exe 3788 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2872 wrote to memory of 3016 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe splwow64.exe PID 2872 wrote to memory of 3016 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe splwow64.exe PID 2872 wrote to memory of 3016 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe splwow64.exe PID 2872 wrote to memory of 3016 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe splwow64.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2872 wrote to memory of 2376 2872 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe PID 2376 wrote to memory of 2568 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe explorer.exe PID 2376 wrote to memory of 2568 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe explorer.exe PID 2376 wrote to memory of 2568 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe explorer.exe PID 2376 wrote to memory of 2568 2376 056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 2568 wrote to memory of 1940 2568 explorer.exe explorer.exe PID 1940 wrote to memory of 3008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 3008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 3008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 3008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1684 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1684 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1684 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1684 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2744 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2744 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2744 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2744 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1008 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2272 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2272 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2272 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2272 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2504 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2504 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2504 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2504 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2876 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2876 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2876 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2876 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2440 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2440 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2440 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2440 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1960 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1960 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1960 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1960 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2056 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2056 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2056 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 2056 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1528 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1528 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1528 1940 explorer.exe spoolsv.exe PID 1940 wrote to memory of 1528 1940 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
\Windows\system\explorer.exeFilesize
2.2MB
MD5cc42334fd326371f4090c0b087467191
SHA15bcafc90821535e2b5fe8c222bd97d3483131773
SHA2567225cd63aa7c3daa742d986b4fd440906f03e0b9609682c2b6e5c7e272007beb
SHA5128212d57b5bee477a7d8de18e9002d82514aa9143a1cd4dcdb33e978752754eafadbc2331f9cf01e35ac55af2c250bacc5b1ef480a0da5964bb66c86ead2d4e1a
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD5fed589f430591fa5b99730fafa9846a4
SHA1ab7987e9ed2a8ee3aa382d479a913335eb5b9406
SHA2564e0282bbe857b50667e943f7a7d2c0d373b659fe60792f4bfca09d2ccd83d56d
SHA512b4f923ebb12012352456243a9e52209baaf7972f1947fb0861e8da1455289c96d99524b196d851031816684c8dedcda312896cb4746471f791b3bb8bdfb7b9be
-
memory/872-1802-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/948-2039-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/956-2400-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1008-1136-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1476-3004-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1492-2592-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1528-1581-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1612-2384-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1612-2450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1660-2886-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1672-1804-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1676-2244-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1684-910-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1724-2773-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1744-2943-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1768-1586-0x0000000002AC0000-0x0000000002C1C000-memory.dmpFilesize
1.4MB
-
memory/1768-1583-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1844-2357-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1844-2270-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1920-1582-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1932-2331-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1940-908-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1960-1579-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2016-1803-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2056-1580-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-2037-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2124-2875-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2216-1805-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2244-2318-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2272-1137-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2292-2282-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-50-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2376-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-28-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2440-1578-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2448-1598-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2484-1806-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2504-1342-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2536-2785-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-2243-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2568-41-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2568-61-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2568-63-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2568-74-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2632-2036-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2652-1801-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2716-1597-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2732-2038-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2744-1135-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2796-1807-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2836-2242-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2872-27-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2872-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2872-19-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2872-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2876-1348-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2892-2040-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2916-2303-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3008-909-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3076-2604-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3104-2429-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3232-2637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3300-2650-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3360-2853-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3412-2471-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3468-2871-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3480-2908-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3552-2679-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3596-2484-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3716-2513-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3740-2722-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3752-2712-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3824-2962-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3928-2737-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4012-2565-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4028-2762-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB