warzonerat | ac5e41b4063cc321280abeb6ecbba14d548f771fd4d3bb3f8031ce756df0ae39

Analysis

max time kernel
145s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
Size

2.9MB
MD5

11c3ec4d59600ba527167aa9af5fda40
SHA1

b225cc2536024e154f9e4abfc1c4ed9113b2ba5b
SHA256

ac5e41b4063cc321280abeb6ecbba14d548f771fd4d3bb3f8031ce756df0ae39
SHA512

168debfd58fe31a89aff2c777c6b78689156c90566be36f5ed5e8aaa0b3f397e6a9480d153793ddc21422b736abe150251f907b5b1df7b3fa38a510faaf2bec4
SSDEEP

24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHk:3Ty7A3mw4gxeOw46fUbNecCCFbNecZ

Score

10^/10

warzonerat evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 6 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 39 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

pid	process
1924	explorer.exe
1672	explorer.exe
2956	explorer.exe
2872	spoolsv.exe
2876	spoolsv.exe
2072	spoolsv.exe
1044	spoolsv.exe
2552	spoolsv.exe
2532	spoolsv.exe
576	spoolsv.exe
2468	spoolsv.exe
612	spoolsv.exe
852	spoolsv.exe
2100	spoolsv.exe
2892	spoolsv.exe
676	spoolsv.exe
1500	spoolsv.exe
1828	spoolsv.exe
2848	spoolsv.exe
792	spoolsv.exe
2640	spoolsv.exe
2452	spoolsv.exe
1716	spoolsv.exe
2652	spoolsv.exe
1300	spoolsv.exe
3000	spoolsv.exe
1968	spoolsv.exe
832	spoolsv.exe
1792	spoolsv.exe
332	spoolsv.exe
2976	spoolsv.exe
768	spoolsv.exe
2908	spoolsv.exe
1344	explorer.exe
1588	spoolsv.exe
2596	spoolsv.exe
2040	spoolsv.exe
1332	explorer.exe
2612	spoolsv.exe

Loads dropped DLL 54 IoCs

Processes:

11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
2956	explorer.exe
2956	explorer.exe
2872	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2072	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2552	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
576	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
612	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2100	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
676	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
1828	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
792	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2452	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2652	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
3000	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
832	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
332	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
768	spoolsv.exe
2876	spoolsv.exe
2908	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2596	spoolsv.exe
1044	spoolsv.exe
2532	spoolsv.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

spoolsv.exespoolsv.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exeexplorer.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 28 IoCs

Processes:

11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 2196 set thread context of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 set thread context of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 set thread context of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 1924 set thread context of 1672	1924	explorer.exe	explorer.exe
PID 1672 set thread context of 2956	1672	explorer.exe	explorer.exe
PID 1672 set thread context of 1604	1672	explorer.exe	diskperf.exe
PID 2872 set thread context of 2876	2872	spoolsv.exe	spoolsv.exe
PID 2072 set thread context of 1044	2072	spoolsv.exe	spoolsv.exe
PID 2552 set thread context of 2532	2552	spoolsv.exe	spoolsv.exe
PID 576 set thread context of 2468	576	spoolsv.exe	spoolsv.exe
PID 612 set thread context of 852	612	spoolsv.exe	spoolsv.exe
PID 2100 set thread context of 2892	2100	spoolsv.exe	spoolsv.exe
PID 676 set thread context of 1500	676	spoolsv.exe	spoolsv.exe
PID 1828 set thread context of 2848	1828	spoolsv.exe	spoolsv.exe
PID 792 set thread context of 2640	792	spoolsv.exe	spoolsv.exe
PID 2452 set thread context of 1716	2452	spoolsv.exe	spoolsv.exe
PID 2652 set thread context of 1300	2652	spoolsv.exe	spoolsv.exe
PID 3000 set thread context of 1968	3000	spoolsv.exe	spoolsv.exe
PID 832 set thread context of 1792	832	spoolsv.exe	spoolsv.exe
PID 332 set thread context of 2976	332	spoolsv.exe	spoolsv.exe
PID 2876 set thread context of 2908	2876	spoolsv.exe	spoolsv.exe
PID 768 set thread context of 1588	768	spoolsv.exe	spoolsv.exe
PID 2876 set thread context of 2552	2876	spoolsv.exe	diskperf.exe
PID 1044 set thread context of 2040	1044	spoolsv.exe	spoolsv.exe
PID 1344 set thread context of 1332	1344	explorer.exe	explorer.exe
PID 1044 set thread context of 1308	1044	spoolsv.exe	diskperf.exe
PID 2596 set thread context of 1636	2596	spoolsv.exe	spoolsv.exe
PID 2532 set thread context of 2612	2532	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 21 IoCs

Processes:

spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

pid	process
2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
1924	explorer.exe
2872	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2072	spoolsv.exe
2956	explorer.exe
2552	spoolsv.exe
2956	explorer.exe
576	spoolsv.exe
2956	explorer.exe
612	spoolsv.exe
2956	explorer.exe
2100	spoolsv.exe
2956	explorer.exe
676	spoolsv.exe
2956	explorer.exe
1828	spoolsv.exe
2956	explorer.exe
792	spoolsv.exe
2956	explorer.exe
2452	spoolsv.exe
2956	explorer.exe
2652	spoolsv.exe
2956	explorer.exe
3000	spoolsv.exe
2956	explorer.exe
832	spoolsv.exe
2956	explorer.exe
332	spoolsv.exe
2956	explorer.exe
768	spoolsv.exe
2956	explorer.exe
1344	explorer.exe
2596	spoolsv.exe

Suspicious use of SetWindowsHookEx 48 IoCs

Processes:

pid	process
2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
1924	explorer.exe
1924	explorer.exe
2956	explorer.exe
2956	explorer.exe
2872	spoolsv.exe
2872	spoolsv.exe
2956	explorer.exe
2956	explorer.exe
2072	spoolsv.exe
2072	spoolsv.exe
2552	spoolsv.exe
2552	spoolsv.exe
576	spoolsv.exe
576	spoolsv.exe
612	spoolsv.exe
612	spoolsv.exe
2100	spoolsv.exe
2100	spoolsv.exe
676	spoolsv.exe
676	spoolsv.exe
1828	spoolsv.exe
1828	spoolsv.exe
792	spoolsv.exe
792	spoolsv.exe
2452	spoolsv.exe
2452	spoolsv.exe
2652	spoolsv.exe
2652	spoolsv.exe
3000	spoolsv.exe
3000	spoolsv.exe
832	spoolsv.exe
832	spoolsv.exe
332	spoolsv.exe
332	spoolsv.exe
768	spoolsv.exe
768	spoolsv.exe
2908	spoolsv.exe
2908	spoolsv.exe
1344	explorer.exe
1344	explorer.exe
2596	spoolsv.exe
2596	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2196 wrote to memory of 2264	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2264	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2264	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2264	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	cmd.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2196 wrote to memory of 2832	2196	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 564	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 2832 wrote to memory of 2708	2832	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	diskperf.exe
PID 564 wrote to memory of 1924	564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	explorer.exe
PID 564 wrote to memory of 1924	564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	explorer.exe
PID 564 wrote to memory of 1924	564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	explorer.exe
PID 564 wrote to memory of 1924	564	11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe	explorer.exe
PID 1924 wrote to memory of 2284	1924	explorer.exe	cmd.exe
PID 1924 wrote to memory of 2284	1924	explorer.exe	cmd.exe
PID 1924 wrote to memory of 2284	1924	explorer.exe	cmd.exe
PID 1924 wrote to memory of 2284	1924	explorer.exe	cmd.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe
PID 1924 wrote to memory of 1672	1924	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:2264

C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\11c3ec4d59600ba527167aa9af5fda40_JaffaCakes118.exe
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
5⤵
- Drops startup file
PID:2284

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1672

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1088

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2908

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:2636

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
- Executes dropped EXE
PID:1332

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1308

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2632

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2532

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
- Executes dropped EXE
PID:2612

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
PID:2764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:1880

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:2516

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:544

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2656

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:852

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1096

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1092

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1500

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2868

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2848

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1164

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2640

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2560

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1716

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1896

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1300

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2756

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1968

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1600

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1792

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:908

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2976

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2196

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:1892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1636

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1652

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2932

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
6⤵
PID:1604

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
3⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
11c3ec4d59600ba527167aa9af5fda40

SHA1
b225cc2536024e154f9e4abfc1c4ed9113b2ba5b

SHA256
ac5e41b4063cc321280abeb6ecbba14d548f771fd4d3bb3f8031ce756df0ae39

SHA512
168debfd58fe31a89aff2c777c6b78689156c90566be36f5ed5e8aaa0b3f397e6a9480d153793ddc21422b736abe150251f907b5b1df7b3fa38a510faaf2bec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
341eb3cf4f01afc8f31f544d440a7a8e

SHA1
362ba627de203e8bfd852f20fbd2652f5beddd9c

SHA256
26c7cc1559ba9079fcbf5219a36409ee5f1900192cbc5fabcb86d8801d632766

SHA512
0ceef1675341bc932fc45d40c8ac44077ab02c0fdf9474c2107c4334aeb85b2bb6047bcdf2a4eafb2e5f18f6f2e411e7d1be19bc78b1381f63e5c23c158c6cff

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
dec5778ce5d225e79655aacb57c35154

SHA1
959aaf20ee7e6653d82e0f0cc22b09548a7d068d

SHA256
cefb58ef176ceafb9f505adbda8533a5f49d5a772f634ee079e3bf48ff7d4161

SHA512
bd84f3910c0be18d81577009830a83284c031364ae69be8ba4069e35b91c21245caab0c1c9cd71b4ab2dad07a9b9a87bb6c99f06a2c59ec65972914b9fb8f41e

Download Submit
memory/564-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-70-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/852-444-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1044-282-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1044-1066-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1300-754-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/1500-554-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1672-144-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1672-180-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1716-752-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1792-850-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1968-801-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2468-394-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2532-1115-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2532-340-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2640-656-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2708-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2832-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-31-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-49-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2832-48-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2832-6-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-4-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-2-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-29-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2832-84-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2832-36-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-41-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2832-40-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-46-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2832-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2832-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-8-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-19-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-13-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2832-43-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-15-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-45-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-42-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-47-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-22-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2832-39-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2876-961-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2876-242-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2892-494-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2908-974-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-1058-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2976-973-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download