Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 23:25
Behavioral task
behavioral1
Sample
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
1eb1bdf1d54d02f4c3dcf15d5204c976
-
SHA1
8d04c18e5f8236b44ea0c59b0d4aa609df3910e0
-
SHA256
48236b9e017ff6b1a3eb10fe7161751a611cb9debe664ef0f421cae3ebf4d28e
-
SHA512
cf506afb91f0e2f11ab4082e87fc5b4739028a23e79268056d791fcea2a2b42edacb5302e9fb9de9e4c1a775933048716b389b14cdd09e541e7fab043ca7fbe3
-
SSDEEP
24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81+:fF6mw4gxeOw46fUbNecCCFbNec0
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule \??\c:\windows\system\explorer.exe warzonerat \??\c:\windows\system\spoolsv.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 35 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2388 explorer.exe 2932 explorer.exe 2212 explorer.exe 1536 spoolsv.exe 2028 spoolsv.exe 2068 spoolsv.exe 2736 spoolsv.exe 2412 spoolsv.exe 2544 spoolsv.exe 2800 spoolsv.exe 2928 spoolsv.exe 1748 spoolsv.exe 3028 spoolsv.exe 1396 spoolsv.exe 624 spoolsv.exe 852 spoolsv.exe 1740 spoolsv.exe 1632 spoolsv.exe 3036 spoolsv.exe 2540 spoolsv.exe 2464 spoolsv.exe 660 spoolsv.exe 2512 spoolsv.exe 2248 spoolsv.exe 1392 spoolsv.exe 2332 spoolsv.exe 604 spoolsv.exe 2696 spoolsv.exe 1584 spoolsv.exe 612 spoolsv.exe 1572 spoolsv.exe 1916 spoolsv.exe 2704 spoolsv.exe 2180 spoolsv.exe 2884 spoolsv.exe 344 spoolsv.exe 2480 spoolsv.exe 2592 spoolsv.exe 1552 spoolsv.exe 2312 spoolsv.exe 2308 spoolsv.exe 572 spoolsv.exe 1972 spoolsv.exe 2316 spoolsv.exe 1792 spoolsv.exe 2424 spoolsv.exe 2488 spoolsv.exe 2548 spoolsv.exe 112 spoolsv.exe 2096 spoolsv.exe 2844 spoolsv.exe 1784 spoolsv.exe 1532 spoolsv.exe 2380 spoolsv.exe 2776 spoolsv.exe 2584 spoolsv.exe 924 spoolsv.exe 2728 spoolsv.exe 2436 spoolsv.exe 2700 spoolsv.exe 2684 spoolsv.exe 2004 spoolsv.exe 1984 spoolsv.exe 3044 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2212 explorer.exe 2212 explorer.exe 1536 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2068 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2412 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2800 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 1748 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 1396 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 852 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 1632 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2540 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 660 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2248 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2332 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2696 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 612 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 1916 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2180 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 344 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2592 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2312 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 572 spoolsv.exe 2212 explorer.exe 2212 explorer.exe -
Processes:
resource yara_rule behavioral1/memory/2964-0-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2964-44-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2388-101-0x0000000000400000-0x0000000000445000-memory.dmp upx \??\c:\windows\system\explorer.exe upx \??\c:\windows\system\spoolsv.exe upx behavioral1/memory/1536-199-0x0000000000400000-0x0000000000445000-memory.dmp upx C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe upx behavioral1/memory/2068-256-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2412-310-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2800-366-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1748-419-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1396-474-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/852-529-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/852-538-0x0000000001C10000-0x0000000001C55000-memory.dmp upx behavioral1/memory/1632-585-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2540-640-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/660-697-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2248-751-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2248-768-0x0000000000450000-0x0000000000495000-memory.dmp upx -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 2964 set thread context of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 set thread context of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 set thread context of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2388 set thread context of 2932 2388 explorer.exe explorer.exe PID 2932 set thread context of 2212 2932 explorer.exe explorer.exe PID 2932 set thread context of 2072 2932 explorer.exe diskperf.exe PID 1536 set thread context of 2028 1536 spoolsv.exe spoolsv.exe PID 2068 set thread context of 2736 2068 spoolsv.exe spoolsv.exe PID 2412 set thread context of 2544 2412 spoolsv.exe spoolsv.exe PID 2800 set thread context of 2928 2800 spoolsv.exe spoolsv.exe PID 1748 set thread context of 3028 1748 spoolsv.exe spoolsv.exe PID 1396 set thread context of 624 1396 spoolsv.exe spoolsv.exe PID 852 set thread context of 1740 852 spoolsv.exe spoolsv.exe PID 1632 set thread context of 3036 1632 spoolsv.exe spoolsv.exe PID 2540 set thread context of 2464 2540 spoolsv.exe spoolsv.exe PID 660 set thread context of 2512 660 spoolsv.exe spoolsv.exe PID 2248 set thread context of 1392 2248 spoolsv.exe spoolsv.exe PID 2332 set thread context of 604 2332 spoolsv.exe spoolsv.exe PID 2696 set thread context of 1584 2696 spoolsv.exe spoolsv.exe PID 612 set thread context of 1572 612 spoolsv.exe spoolsv.exe PID 1916 set thread context of 2704 1916 spoolsv.exe spoolsv.exe PID 2180 set thread context of 2884 2180 spoolsv.exe spoolsv.exe PID 344 set thread context of 2480 344 spoolsv.exe spoolsv.exe PID 2592 set thread context of 1552 2592 spoolsv.exe spoolsv.exe PID 2312 set thread context of 2308 2312 spoolsv.exe spoolsv.exe PID 572 set thread context of 1972 572 spoolsv.exe spoolsv.exe PID 2316 set thread context of 1792 2316 spoolsv.exe spoolsv.exe PID 2424 set thread context of 2488 2424 spoolsv.exe spoolsv.exe PID 2548 set thread context of 112 2548 spoolsv.exe spoolsv.exe PID 2096 set thread context of 2844 2096 spoolsv.exe spoolsv.exe PID 1784 set thread context of 1532 1784 spoolsv.exe spoolsv.exe PID 2380 set thread context of 2776 2380 spoolsv.exe spoolsv.exe PID 2584 set thread context of 924 2584 spoolsv.exe spoolsv.exe PID 2728 set thread context of 2436 2728 spoolsv.exe spoolsv.exe PID 2700 set thread context of 2684 2700 spoolsv.exe spoolsv.exe PID 2004 set thread context of 1984 2004 spoolsv.exe spoolsv.exe PID 3044 set thread context of 2444 3044 spoolsv.exe spoolsv.exe PID 948 set thread context of 1420 948 spoolsv.exe spoolsv.exe PID 3008 set thread context of 328 3008 spoolsv.exe spoolsv.exe PID 1620 set thread context of 452 1620 spoolsv.exe spoolsv.exe PID 2616 set thread context of 768 2616 spoolsv.exe spoolsv.exe PID 1408 set thread context of 2004 1408 spoolsv.exe spoolsv.exe PID 2028 set thread context of 1580 2028 spoolsv.exe spoolsv.exe PID 2028 set thread context of 1596 2028 spoolsv.exe diskperf.exe PID 2848 set thread context of 2772 2848 spoolsv.exe spoolsv.exe PID 2736 set thread context of 2648 2736 spoolsv.exe spoolsv.exe PID 1212 set thread context of 1176 1212 explorer.exe explorer.exe PID 2736 set thread context of 612 2736 spoolsv.exe diskperf.exe PID 2544 set thread context of 2400 2544 spoolsv.exe spoolsv.exe PID 2544 set thread context of 1688 2544 spoolsv.exe diskperf.exe PID 1872 set thread context of 2788 1872 spoolsv.exe spoolsv.exe PID 2928 set thread context of 2764 2928 spoolsv.exe spoolsv.exe PID 2928 set thread context of 2680 2928 spoolsv.exe diskperf.exe PID 2396 set thread context of 1616 2396 spoolsv.exe spoolsv.exe PID 3028 set thread context of 2368 3028 spoolsv.exe spoolsv.exe PID 2484 set thread context of 1044 2484 explorer.exe explorer.exe PID 3028 set thread context of 2876 3028 spoolsv.exe diskperf.exe PID 3024 set thread context of 2344 3024 spoolsv.exe spoolsv.exe PID 624 set thread context of 2652 624 spoolsv.exe spoolsv.exe PID 624 set thread context of 2036 624 spoolsv.exe diskperf.exe PID 1740 set thread context of 2280 1740 spoolsv.exe spoolsv.exe PID 2608 set thread context of 2372 2608 spoolsv.exe spoolsv.exe PID 2660 set thread context of 1852 2660 explorer.exe explorer.exe PID 1740 set thread context of 1600 1740 spoolsv.exe diskperf.exe -
Drops file in Windows directory 49 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2388 explorer.exe 1536 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2068 spoolsv.exe 2212 explorer.exe 2412 spoolsv.exe 2212 explorer.exe 2800 spoolsv.exe 2212 explorer.exe 1748 spoolsv.exe 2212 explorer.exe 1396 spoolsv.exe 2212 explorer.exe 852 spoolsv.exe 2212 explorer.exe 1632 spoolsv.exe 2212 explorer.exe 2540 spoolsv.exe 2212 explorer.exe 660 spoolsv.exe 2212 explorer.exe 2248 spoolsv.exe 2212 explorer.exe 2332 spoolsv.exe 2212 explorer.exe 2696 spoolsv.exe 2212 explorer.exe 612 spoolsv.exe 2212 explorer.exe 1916 spoolsv.exe 2212 explorer.exe 2180 spoolsv.exe 2212 explorer.exe 344 spoolsv.exe 2212 explorer.exe 2592 spoolsv.exe 2212 explorer.exe 2312 spoolsv.exe 2212 explorer.exe 572 spoolsv.exe 2212 explorer.exe 2316 spoolsv.exe 2212 explorer.exe 2424 spoolsv.exe 2212 explorer.exe 2548 spoolsv.exe 2212 explorer.exe 2096 spoolsv.exe 2212 explorer.exe 1784 spoolsv.exe 2212 explorer.exe 2380 spoolsv.exe 2212 explorer.exe 2584 spoolsv.exe 2212 explorer.exe 2728 spoolsv.exe 2212 explorer.exe 2700 spoolsv.exe 2212 explorer.exe 2004 spoolsv.exe 2212 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 2388 explorer.exe 2388 explorer.exe 2212 explorer.exe 2212 explorer.exe 1536 spoolsv.exe 1536 spoolsv.exe 2212 explorer.exe 2212 explorer.exe 2068 spoolsv.exe 2068 spoolsv.exe 2412 spoolsv.exe 2412 spoolsv.exe 2800 spoolsv.exe 2800 spoolsv.exe 1748 spoolsv.exe 1748 spoolsv.exe 1396 spoolsv.exe 1396 spoolsv.exe 852 spoolsv.exe 852 spoolsv.exe 1632 spoolsv.exe 1632 spoolsv.exe 2540 spoolsv.exe 2540 spoolsv.exe 660 spoolsv.exe 660 spoolsv.exe 2248 spoolsv.exe 2248 spoolsv.exe 2332 spoolsv.exe 2332 spoolsv.exe 2696 spoolsv.exe 2696 spoolsv.exe 612 spoolsv.exe 612 spoolsv.exe 1916 spoolsv.exe 1916 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 344 spoolsv.exe 344 spoolsv.exe 2592 spoolsv.exe 2592 spoolsv.exe 2312 spoolsv.exe 2312 spoolsv.exe 572 spoolsv.exe 572 spoolsv.exe 2316 spoolsv.exe 2316 spoolsv.exe 2424 spoolsv.exe 2424 spoolsv.exe 2548 spoolsv.exe 2548 spoolsv.exe 2096 spoolsv.exe 2096 spoolsv.exe 1784 spoolsv.exe 1784 spoolsv.exe 2380 spoolsv.exe 2380 spoolsv.exe 2584 spoolsv.exe 2584 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeexplorer.exedescription pid process target process PID 2964 wrote to memory of 2968 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2968 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2968 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2968 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2964 wrote to memory of 2504 2964 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2744 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2504 wrote to memory of 2808 2504 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe diskperf.exe PID 2744 wrote to memory of 2388 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe explorer.exe PID 2744 wrote to memory of 2388 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe explorer.exe PID 2744 wrote to memory of 2388 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe explorer.exe PID 2744 wrote to memory of 2388 2744 1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe explorer.exe PID 2388 wrote to memory of 1748 2388 explorer.exe cmd.exe PID 2388 wrote to memory of 1748 2388 explorer.exe cmd.exe PID 2388 wrote to memory of 1748 2388 explorer.exe cmd.exe PID 2388 wrote to memory of 1748 2388 explorer.exe cmd.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe PID 2388 wrote to memory of 2932 2388 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1eb1bdf1d54d02f4c3dcf15d5204c976_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:1748 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2932 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1644 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1580
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:900 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1176
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2648
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2400
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:860 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1044
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2764
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:3028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2368
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2492
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2652
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
- Drops startup file
PID:988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1852
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:948 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2280
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3036 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2816
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:2604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2256
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2728
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2464 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2720
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1540
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:2656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:1404
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:2420
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2460
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:792
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1648
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2900
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:1612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:2472
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1728
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2248 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1472 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2820 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:924 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2684 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1984 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2444
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1420
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2176 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:992
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2788
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1616
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2160
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2168 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2960
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2072
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:2808
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-12409846437888976418742087-1854395741-19921734121100454955102271692603298136"1⤵PID:948
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51eb1bdf1d54d02f4c3dcf15d5204c976
SHA18d04c18e5f8236b44ea0c59b0d4aa609df3910e0
SHA25648236b9e017ff6b1a3eb10fe7161751a611cb9debe664ef0f421cae3ebf4d28e
SHA512cf506afb91f0e2f11ab4082e87fc5b4739028a23e79268056d791fcea2a2b42edacb5302e9fb9de9e4c1a775933048716b389b14cdd09e541e7fab043ca7fbe3
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.7MB
MD52f2681ddb0a4aaee5ff472d5ea1c13c3
SHA1f5a03e2e62ac93f5b38c67c4c6765449f9c0050d
SHA256a102897471a234de164fe4009e49772cf11d32b6e39f09c3e4759174a641cd3b
SHA5123d739e92364138d18b601f061b9b38d2db0cb8cb1cf04ef0bb5bace32d97e72b8c04772fc3c0a3eb8a309a7d1adcf9bd1e978f6d5a49ea8512b15e2d428d9689
-
Filesize
2.7MB
MD5302cf5e9068fa50177cf0b27c1bc089e
SHA1452b95710c828673316c9e732f1bb02d086a52b6
SHA256c6e3db7807e146faa1bbd73cd64c369e97bbf9d4f0c260e9569bf28c5b287df7
SHA5124bece238c3f8a116d25a1a9cb3d5a83643e24691bc7b82a165c516fd32b8aac904ee4153ea2524064aab42ccd4f8f56ae681952662083fdde42bed9076d689e7