Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 14:33
Behavioral task
behavioral1
Sample
056756674108530c852acb294836b90b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
056756674108530c852acb294836b90b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
056756674108530c852acb294836b90b
-
SHA1
6a20b78ee2246909091836d89c1e7515e6bbe55a
-
SHA256
ac6900fdea4024dac56bca34ceeeb78cf97a6e9edae9773c0ae0057a1be42049
-
SHA512
4a25857db0dc09bad30381e86ed16e6b662314000642c8805201c6af7872118e4ab4f6f8b186723319cb162c50c096f1374f93eae5c75c116398dad6f5336cfd
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZA:0UzeyQMS4DqodCnoe+iitjWwwk
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 2844 explorer.exe 2860 explorer.exe 1820 spoolsv.exe 2184 spoolsv.exe 1128 spoolsv.exe 1812 spoolsv.exe 2148 spoolsv.exe 2516 spoolsv.exe 2244 spoolsv.exe 2756 spoolsv.exe 2248 spoolsv.exe 2264 spoolsv.exe 2976 spoolsv.exe 980 spoolsv.exe 1592 spoolsv.exe 2760 spoolsv.exe 2536 spoolsv.exe 2832 spoolsv.exe 2220 spoolsv.exe 468 spoolsv.exe 1800 spoolsv.exe 3064 spoolsv.exe 2684 spoolsv.exe 1628 spoolsv.exe 1172 spoolsv.exe 1836 spoolsv.exe 2196 spoolsv.exe 1720 spoolsv.exe 2764 spoolsv.exe 888 spoolsv.exe 2052 spoolsv.exe 2292 spoolsv.exe 2992 spoolsv.exe 1408 spoolsv.exe 2700 spoolsv.exe 1324 spoolsv.exe 1372 spoolsv.exe 2628 spoolsv.exe 3028 spoolsv.exe 2160 spoolsv.exe 836 spoolsv.exe 1656 spoolsv.exe 1028 spoolsv.exe 1572 spoolsv.exe 2836 spoolsv.exe 764 spoolsv.exe 1688 spoolsv.exe 2912 spoolsv.exe 2552 spoolsv.exe 2304 spoolsv.exe 1156 spoolsv.exe 2840 spoolsv.exe 3032 spoolsv.exe 2100 spoolsv.exe 2376 spoolsv.exe 2456 explorer.exe 584 spoolsv.exe 304 spoolsv.exe 1940 spoolsv.exe 1960 spoolsv.exe 2588 spoolsv.exe 1460 spoolsv.exe 2200 explorer.exe 2784 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exepid process 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1440 set thread context of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 2844 set thread context of 2860 2844 explorer.exe explorer.exe PID 1820 set thread context of 2376 1820 spoolsv.exe spoolsv.exe PID 2184 set thread context of 584 2184 spoolsv.exe spoolsv.exe PID 1812 set thread context of 304 1812 spoolsv.exe spoolsv.exe PID 1128 set thread context of 1940 1128 spoolsv.exe spoolsv.exe PID 2516 set thread context of 2588 2516 spoolsv.exe spoolsv.exe PID 2148 set thread context of 1460 2148 spoolsv.exe spoolsv.exe PID 2756 set thread context of 2784 2756 spoolsv.exe spoolsv.exe PID 2264 set thread context of 2956 2264 spoolsv.exe spoolsv.exe PID 2244 set thread context of 2392 2244 spoolsv.exe spoolsv.exe PID 980 set thread context of 3228 980 spoolsv.exe spoolsv.exe PID 2248 set thread context of 3300 2248 spoolsv.exe spoolsv.exe PID 2976 set thread context of 3332 2976 spoolsv.exe spoolsv.exe PID 2760 set thread context of 3452 2760 spoolsv.exe spoolsv.exe PID 2832 set thread context of 3520 2832 spoolsv.exe spoolsv.exe PID 1592 set thread context of 3528 1592 spoolsv.exe spoolsv.exe PID 468 set thread context of 3640 468 spoolsv.exe spoolsv.exe PID 3064 set thread context of 3652 3064 spoolsv.exe spoolsv.exe PID 2536 set thread context of 3660 2536 spoolsv.exe spoolsv.exe PID 1628 set thread context of 3768 1628 spoolsv.exe spoolsv.exe PID 1836 set thread context of 3960 1836 spoolsv.exe spoolsv.exe PID 3032 set thread context of 4016 3032 spoolsv.exe spoolsv.exe PID 2220 set thread context of 4032 2220 spoolsv.exe spoolsv.exe PID 888 set thread context of 1052 888 spoolsv.exe spoolsv.exe PID 1720 set thread context of 2044 1720 spoolsv.exe spoolsv.exe PID 1800 set thread context of 2144 1800 spoolsv.exe spoolsv.exe PID 2684 set thread context of 2080 2684 spoolsv.exe spoolsv.exe PID 2292 set thread context of 3104 2292 spoolsv.exe spoolsv.exe PID 1172 set thread context of 564 1172 spoolsv.exe spoolsv.exe PID 1324 set thread context of 3336 1324 spoolsv.exe spoolsv.exe PID 2196 set thread context of 3268 2196 spoolsv.exe spoolsv.exe PID 2628 set thread context of 2716 2628 spoolsv.exe spoolsv.exe PID 2160 set thread context of 3388 2160 spoolsv.exe spoolsv.exe PID 1572 set thread context of 3404 1572 spoolsv.exe spoolsv.exe PID 1656 set thread context of 3456 1656 spoolsv.exe spoolsv.exe PID 2052 set thread context of 1964 2052 spoolsv.exe spoolsv.exe PID 2912 set thread context of 3468 2912 spoolsv.exe spoolsv.exe PID 2840 set thread context of 3552 2840 spoolsv.exe spoolsv.exe PID 2764 set thread context of 3504 2764 spoolsv.exe spoolsv.exe PID 764 set thread context of 2464 764 spoolsv.exe spoolsv.exe PID 2304 set thread context of 3556 2304 spoolsv.exe spoolsv.exe PID 1028 set thread context of 1020 1028 spoolsv.exe spoolsv.exe PID 2992 set thread context of 692 2992 spoolsv.exe spoolsv.exe PID 1372 set thread context of 2960 1372 spoolsv.exe spoolsv.exe PID 2552 set thread context of 3792 2552 spoolsv.exe spoolsv.exe PID 3028 set thread context of 3944 3028 spoolsv.exe spoolsv.exe PID 836 set thread context of 3720 836 spoolsv.exe spoolsv.exe PID 2700 set thread context of 3752 2700 spoolsv.exe spoolsv.exe PID 1156 set thread context of 3836 1156 spoolsv.exe spoolsv.exe PID 1688 set thread context of 3888 1688 spoolsv.exe spoolsv.exe PID 2836 set thread context of 3920 2836 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 056756674108530c852acb294836b90b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exepid process 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2860 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2860 explorer.exe 2376 spoolsv.exe 2376 spoolsv.exe 584 spoolsv.exe 584 spoolsv.exe 304 spoolsv.exe 304 spoolsv.exe 1940 spoolsv.exe 1940 spoolsv.exe 2588 spoolsv.exe 2588 spoolsv.exe 1460 spoolsv.exe 1460 spoolsv.exe 2784 spoolsv.exe 2784 spoolsv.exe 2956 spoolsv.exe 2956 spoolsv.exe 2392 spoolsv.exe 2392 spoolsv.exe 3228 spoolsv.exe 3228 spoolsv.exe 3300 spoolsv.exe 3300 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 3452 spoolsv.exe 3452 spoolsv.exe 3520 spoolsv.exe 3520 spoolsv.exe 3528 spoolsv.exe 3528 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 3652 spoolsv.exe 3652 spoolsv.exe 3660 spoolsv.exe 3660 spoolsv.exe 3960 spoolsv.exe 3960 spoolsv.exe 3552 spoolsv.exe 3404 spoolsv.exe 3404 spoolsv.exe 3020 spoolsv.exe 3020 spoolsv.exe 3552 spoolsv.exe 2144 spoolsv.exe 3768 spoolsv.exe 2144 spoolsv.exe 2716 spoolsv.exe 3468 spoolsv.exe 3268 spoolsv.exe 3768 spoolsv.exe 4016 spoolsv.exe 3268 spoolsv.exe 3468 spoolsv.exe 1964 spoolsv.exe 3388 spoolsv.exe 4016 spoolsv.exe 3104 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
056756674108530c852acb294836b90b_JaffaCakes118.exe056756674108530c852acb294836b90b_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1440 wrote to memory of 1224 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe splwow64.exe PID 1440 wrote to memory of 1224 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe splwow64.exe PID 1440 wrote to memory of 1224 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe splwow64.exe PID 1440 wrote to memory of 1224 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe splwow64.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 1440 wrote to memory of 2468 1440 056756674108530c852acb294836b90b_JaffaCakes118.exe 056756674108530c852acb294836b90b_JaffaCakes118.exe PID 2468 wrote to memory of 2844 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe explorer.exe PID 2468 wrote to memory of 2844 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe explorer.exe PID 2468 wrote to memory of 2844 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe explorer.exe PID 2468 wrote to memory of 2844 2468 056756674108530c852acb294836b90b_JaffaCakes118.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2844 wrote to memory of 2860 2844 explorer.exe explorer.exe PID 2860 wrote to memory of 1820 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1820 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1820 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1820 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2184 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2184 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2184 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2184 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1128 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1128 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1128 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1128 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1812 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1812 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1812 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 1812 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2148 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2148 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2148 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2148 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2516 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2516 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2516 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2516 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2244 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2244 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2244 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2244 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2756 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2756 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2756 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2756 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2248 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2248 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2248 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2248 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2264 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2264 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2264 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2264 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2976 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2976 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2976 2860 explorer.exe spoolsv.exe PID 2860 wrote to memory of 2976 2860 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\056756674108530c852acb294836b90b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056756674108530c852acb294836b90b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\056756674108530c852acb294836b90b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056756674108530c852acb294836b90b_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
\Windows\system\explorer.exeFilesize
2.2MB
MD5f12f37770c0e054ba5f4f28fbd28ca27
SHA167a8e1b7cce47e93dcfb64fa4e83d6da0acf4cee
SHA2569e4ff14dc657d25cb9328d475deee70c0c505409dfddff8ea2cab25cd404b04b
SHA5124f56eabba19dbdf192bae22e429b03bd182f182fe1b5f3f0dfe0f0a7c42cf53b2f17c155ab71a536bff1d1ad9952b5a95bbce8292dd536dc6d01a45d46d92455
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD5f87b1aadd9062627f841f8a954784c1b
SHA15a7bd8fbbd917f0a61c726f325947a0d0b969087
SHA256d68c037767030cf34f5dc423dd656f465d59447736ae077c9b86f417584717af
SHA512085ab4c55b53da8730cf562f07006e8b673c5f10c961b2c809e1d27b573ac182d2dd092e2596c6e0aa982e53655f90d1a29254e1efe09f550e9b98b16ba06ba1
-
memory/304-2172-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/468-1589-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/564-2969-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/584-2145-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/888-1930-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/980-1423-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1020-2956-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1128-1034-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1172-1758-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1440-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1440-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1440-19-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1440-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1460-2245-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1592-1424-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1628-1757-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1720-1928-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1800-1754-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1812-1275-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1820-1022-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1836-1759-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1940-2184-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1964-2876-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2052-1931-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2144-2887-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2148-1276-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2184-1023-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2196-1927-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2220-1588-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2244-1280-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2248-1420-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2264-1421-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2292-2118-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2376-2198-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-2133-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2468-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2468-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2468-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2468-49-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2468-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2516-1278-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2536-1586-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2588-2196-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2684-1756-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2716-2885-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2756-1419-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2760-1585-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2764-1929-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2784-2219-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2832-1587-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2844-41-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2844-62-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2844-70-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2844-60-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2860-1016-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-1422-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3020-2871-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3064-1755-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3300-2265-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3332-2278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3336-2927-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3468-2884-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3528-2312-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3552-2883-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3640-2613-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3652-2346-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3660-2358-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3836-2882-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3920-2922-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3960-2934-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4016-2923-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB