Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 15:55
Behavioral task
behavioral1
Sample
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
10e2dd4f425ef30d4f3fe5ec98a03d5d
-
SHA1
2e2b1af404c9d6bde505b373c50fc19872c91498
-
SHA256
794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968
-
SHA512
65483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047
-
SSDEEP
24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHt:3Ty7A3mw4gxeOw46fUbNecCCFbNecU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Windows\System\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 14 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 37 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4112 explorer.exe 1600 explorer.exe 1432 explorer.exe 3328 spoolsv.exe 2792 spoolsv.exe 4664 spoolsv.exe 2564 spoolsv.exe 996 spoolsv.exe 4356 spoolsv.exe 4904 spoolsv.exe 4744 spoolsv.exe 4476 spoolsv.exe 4028 spoolsv.exe 4392 spoolsv.exe 4488 spoolsv.exe 872 spoolsv.exe 3772 spoolsv.exe 1872 spoolsv.exe 4696 spoolsv.exe 1584 spoolsv.exe 2160 spoolsv.exe 720 spoolsv.exe 4824 spoolsv.exe 4692 spoolsv.exe 3172 spoolsv.exe 1812 spoolsv.exe 4140 spoolsv.exe 4572 spoolsv.exe 4448 spoolsv.exe 4308 spoolsv.exe 4136 spoolsv.exe 3472 spoolsv.exe 2332 spoolsv.exe 5072 spoolsv.exe 4812 spoolsv.exe 2632 spoolsv.exe 2120 spoolsv.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
spoolsv.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 22 IoCs
Processes:
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 5112 set thread context of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 set thread context of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 set thread context of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4112 set thread context of 1600 4112 explorer.exe explorer.exe PID 1600 set thread context of 1432 1600 explorer.exe explorer.exe PID 3328 set thread context of 2792 3328 spoolsv.exe spoolsv.exe PID 4664 set thread context of 2564 4664 spoolsv.exe spoolsv.exe PID 996 set thread context of 4356 996 spoolsv.exe spoolsv.exe PID 4904 set thread context of 4744 4904 spoolsv.exe spoolsv.exe PID 4476 set thread context of 4028 4476 spoolsv.exe spoolsv.exe PID 4392 set thread context of 4488 4392 spoolsv.exe spoolsv.exe PID 872 set thread context of 3772 872 spoolsv.exe spoolsv.exe PID 1872 set thread context of 4696 1872 spoolsv.exe spoolsv.exe PID 1584 set thread context of 2160 1584 spoolsv.exe spoolsv.exe PID 720 set thread context of 4824 720 spoolsv.exe spoolsv.exe PID 4692 set thread context of 3172 4692 spoolsv.exe spoolsv.exe PID 1812 set thread context of 4140 1812 spoolsv.exe spoolsv.exe PID 4572 set thread context of 4448 4572 spoolsv.exe spoolsv.exe PID 4308 set thread context of 4136 4308 spoolsv.exe spoolsv.exe PID 3472 set thread context of 2332 3472 spoolsv.exe spoolsv.exe PID 5072 set thread context of 4812 5072 spoolsv.exe spoolsv.exe PID 2792 set thread context of 2632 2792 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 20 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4112 explorer.exe 4112 explorer.exe 3328 spoolsv.exe 3328 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 1432 explorer.exe 1432 explorer.exe 4664 spoolsv.exe 4664 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 996 spoolsv.exe 996 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4904 spoolsv.exe 4904 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4476 spoolsv.exe 4476 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4392 spoolsv.exe 4392 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 872 spoolsv.exe 872 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 1872 spoolsv.exe 1872 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 1584 spoolsv.exe 1584 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 720 spoolsv.exe 720 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4692 spoolsv.exe 4692 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 1812 spoolsv.exe 1812 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4572 spoolsv.exe 4572 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4308 spoolsv.exe 4308 spoolsv.exe 1432 explorer.exe 1432 explorer.exe -
Suspicious use of SetWindowsHookEx 42 IoCs
Processes:
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 4112 explorer.exe 4112 explorer.exe 1432 explorer.exe 1432 explorer.exe 3328 spoolsv.exe 3328 spoolsv.exe 1432 explorer.exe 1432 explorer.exe 4664 spoolsv.exe 4664 spoolsv.exe 996 spoolsv.exe 996 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 4476 spoolsv.exe 4476 spoolsv.exe 4392 spoolsv.exe 4392 spoolsv.exe 872 spoolsv.exe 872 spoolsv.exe 1872 spoolsv.exe 1872 spoolsv.exe 1584 spoolsv.exe 1584 spoolsv.exe 720 spoolsv.exe 720 spoolsv.exe 4692 spoolsv.exe 4692 spoolsv.exe 1812 spoolsv.exe 1812 spoolsv.exe 4572 spoolsv.exe 4572 spoolsv.exe 4308 spoolsv.exe 4308 spoolsv.exe 3472 spoolsv.exe 3472 spoolsv.exe 5072 spoolsv.exe 5072 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeexplorer.exedescription pid process target process PID 5112 wrote to memory of 3160 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe cmd.exe PID 5112 wrote to memory of 3160 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe cmd.exe PID 5112 wrote to memory of 3160 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe cmd.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 5112 wrote to memory of 4876 5112 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 4976 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe PID 4876 wrote to memory of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4876 wrote to memory of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4876 wrote to memory of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4876 wrote to memory of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4876 wrote to memory of 1104 4876 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe diskperf.exe PID 4976 wrote to memory of 4112 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe explorer.exe PID 4976 wrote to memory of 4112 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe explorer.exe PID 4976 wrote to memory of 4112 4976 10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe explorer.exe PID 4112 wrote to memory of 4024 4112 explorer.exe cmd.exe PID 4112 wrote to memory of 4024 4112 explorer.exe cmd.exe PID 4112 wrote to memory of 4024 4112 explorer.exe cmd.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe PID 4112 wrote to memory of 1600 4112 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\10e2dd4f425ef30d4f3fe5ec98a03d5d_JaffaCakes118.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:4024 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1600 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
- Executes dropped EXE
PID:2632 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:1376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:4424
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:260
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4752
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2244
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:4472
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:1824
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2176 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3772 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4824 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:4604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2748
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:1056
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD510e2dd4f425ef30d4f3fe5ec98a03d5d
SHA12e2b1af404c9d6bde505b373c50fc19872c91498
SHA256794b9a2b8b506360ba92a9a69c40b303b37e43e88ae408db8a1b86c741014968
SHA51265483b97cf8e46f33700da4e70434f7be3270ab8eacafe1a36a460b2886e3ffa44a4ba4e29f05eeaeee665f0e60990065854fc622866ebe0df422c60c9238047
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD587c49526bc464c8830b65ff41b62bb7b
SHA1a7a9fad04eccdb3289826ac001579a7ed484e6ab
SHA256e37d6fc695351327eb7a62b4be4c20617b54360dabdbfc075a9996bafc0ddc2f
SHA512134e20b39fe944ade10b801562545e00d02649c2af21173fe93c9aea0acecde31f43799a7538d42ec2fe7a1fe357c75df6c8ed92eb639b6b922994c647812f41
-
Filesize
2.9MB
MD5837e67d93c6524c9a3e2a99543f7ba3a
SHA13f1961147c05d11ad373210f910f855de3a91a5c
SHA256d752410f6c644dfcaae3d536d87e4f35387fc38a036cdefa0573aa6a4641fc24
SHA51250e44680107589d74553509eb3b0939568d23bb482eceab1dd71aa6f2ddd581e960faa6d4d2fb6727f214581d2a5d50cecdcf3ea088efda2a03974171add9aa2