Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 14:49
Behavioral task
behavioral1
Sample
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
1d02d54daf75df2128c2b9bb12682f2b
-
SHA1
1fc242fe45d6f7fd8fa6f70c9de5cc84db062f11
-
SHA256
9bf132141bbd8a842f487efecf12ca6a4f0bcbaae8aa578480bea2fb95c5bbaf
-
SHA512
a17fd2af30c0c1ae276f9dc9e19a2662681a5e215e0bd6ec6d59087ce959661d353ed1bb2e1af1b6f9bc255840616f4280b6cd9d247da68a900cf86414bff7fb
-
SSDEEP
24576:3Ty7A3mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHn:3Ty7A3mw4gxeOw46fUbNecCCFbNecK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 3 IoCs
Processes:
resource yara_rule C:\Windows\System\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat \??\c:\windows\system\spoolsv.exe warzonerat -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 30 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4520 explorer.exe 2304 explorer.exe 4132 explorer.exe 3292 spoolsv.exe 4692 spoolsv.exe 3132 spoolsv.exe 4288 spoolsv.exe 2656 spoolsv.exe 404 spoolsv.exe 3372 spoolsv.exe 4824 spoolsv.exe 116 spoolsv.exe 4576 spoolsv.exe 1664 spoolsv.exe 1932 spoolsv.exe 4320 spoolsv.exe 2872 spoolsv.exe 2912 spoolsv.exe 1408 spoolsv.exe 3040 spoolsv.exe 3288 spoolsv.exe 4040 spoolsv.exe 4968 spoolsv.exe 3160 spoolsv.exe 3596 spoolsv.exe 2728 spoolsv.exe 1300 spoolsv.exe 3140 spoolsv.exe 3620 spoolsv.exe 2680 spoolsv.exe 2264 spoolsv.exe 2068 spoolsv.exe 2092 spoolsv.exe 1664 spoolsv.exe 1908 spoolsv.exe 3392 spoolsv.exe 1720 spoolsv.exe 1628 spoolsv.exe 4472 spoolsv.exe 1936 spoolsv.exe 3108 spoolsv.exe 4444 spoolsv.exe 2400 spoolsv.exe 1980 spoolsv.exe 4640 spoolsv.exe 1012 spoolsv.exe 4656 spoolsv.exe 4944 spoolsv.exe 2612 spoolsv.exe 3012 spoolsv.exe 3960 spoolsv.exe 1052 spoolsv.exe 4764 spoolsv.exe 3844 spoolsv.exe 3420 spoolsv.exe 1628 spoolsv.exe 4364 spoolsv.exe 2464 spoolsv.exe 2380 spoolsv.exe 4444 spoolsv.exe 832 spoolsv.exe 2676 spoolsv.exe 2156 spoolsv.exe 1328 spoolsv.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe -
Suspicious use of SetThreadContext 37 IoCs
Processes:
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 4000 set thread context of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 set thread context of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 set thread context of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 4520 set thread context of 2304 4520 explorer.exe explorer.exe PID 2304 set thread context of 4132 2304 explorer.exe explorer.exe PID 2304 set thread context of 4796 2304 explorer.exe diskperf.exe PID 3292 set thread context of 4692 3292 spoolsv.exe spoolsv.exe PID 3132 set thread context of 4288 3132 spoolsv.exe spoolsv.exe PID 2656 set thread context of 404 2656 spoolsv.exe spoolsv.exe PID 3372 set thread context of 4824 3372 spoolsv.exe spoolsv.exe PID 116 set thread context of 4576 116 spoolsv.exe spoolsv.exe PID 1664 set thread context of 1932 1664 spoolsv.exe spoolsv.exe PID 4320 set thread context of 2872 4320 spoolsv.exe spoolsv.exe PID 2912 set thread context of 1408 2912 spoolsv.exe spoolsv.exe PID 3040 set thread context of 3288 3040 spoolsv.exe spoolsv.exe PID 4040 set thread context of 4968 4040 spoolsv.exe spoolsv.exe PID 3160 set thread context of 3596 3160 spoolsv.exe spoolsv.exe PID 2728 set thread context of 1300 2728 spoolsv.exe spoolsv.exe PID 3140 set thread context of 3620 3140 spoolsv.exe spoolsv.exe PID 2680 set thread context of 2264 2680 spoolsv.exe spoolsv.exe PID 1664 set thread context of 1908 1664 spoolsv.exe spoolsv.exe PID 3392 set thread context of 1720 3392 spoolsv.exe spoolsv.exe PID 1628 set thread context of 4472 1628 spoolsv.exe spoolsv.exe PID 1936 set thread context of 3108 1936 spoolsv.exe spoolsv.exe PID 4444 set thread context of 2400 4444 spoolsv.exe spoolsv.exe PID 1980 set thread context of 4640 1980 spoolsv.exe spoolsv.exe PID 1012 set thread context of 4656 1012 spoolsv.exe spoolsv.exe PID 4944 set thread context of 2612 4944 spoolsv.exe spoolsv.exe PID 3012 set thread context of 3960 3012 spoolsv.exe spoolsv.exe PID 1052 set thread context of 4764 1052 spoolsv.exe spoolsv.exe PID 3844 set thread context of 3420 3844 spoolsv.exe spoolsv.exe PID 1628 set thread context of 4364 1628 spoolsv.exe spoolsv.exe PID 2464 set thread context of 2380 2464 spoolsv.exe spoolsv.exe PID 4444 set thread context of 4124 4444 spoolsv.exe spoolsv.exe PID 1408 set thread context of 2276 1408 spoolsv.exe spoolsv.exe PID 1408 set thread context of 4432 1408 spoolsv.exe diskperf.exe PID 4576 set thread context of 676 4576 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 33 IoCs
Processes:
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1548 1596 WerFault.exe spoolsv.exe 4248 4456 WerFault.exe spoolsv.exe 3552 4824 WerFault.exe spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 4520 explorer.exe 4520 explorer.exe 3292 spoolsv.exe 3292 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4132 explorer.exe 4132 explorer.exe 3132 spoolsv.exe 3132 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 2656 spoolsv.exe 2656 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3372 spoolsv.exe 3372 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 116 spoolsv.exe 116 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 1664 spoolsv.exe 1664 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4320 spoolsv.exe 4320 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 2912 spoolsv.exe 2912 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3040 spoolsv.exe 3040 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 4040 spoolsv.exe 4040 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3160 spoolsv.exe 3160 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 2728 spoolsv.exe 2728 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3140 spoolsv.exe 3140 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 2680 spoolsv.exe 2680 spoolsv.exe 4132 explorer.exe 4132 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 4520 explorer.exe 4520 explorer.exe 4132 explorer.exe 4132 explorer.exe 3292 spoolsv.exe 3292 spoolsv.exe 4132 explorer.exe 4132 explorer.exe 3132 spoolsv.exe 3132 spoolsv.exe 2656 spoolsv.exe 2656 spoolsv.exe 3372 spoolsv.exe 3372 spoolsv.exe 116 spoolsv.exe 116 spoolsv.exe 1664 spoolsv.exe 1664 spoolsv.exe 4320 spoolsv.exe 4320 spoolsv.exe 2912 spoolsv.exe 2912 spoolsv.exe 3040 spoolsv.exe 3040 spoolsv.exe 4040 spoolsv.exe 4040 spoolsv.exe 3160 spoolsv.exe 3160 spoolsv.exe 2728 spoolsv.exe 2728 spoolsv.exe 3140 spoolsv.exe 3140 spoolsv.exe 2680 spoolsv.exe 2680 spoolsv.exe 1664 spoolsv.exe 1664 spoolsv.exe 3392 spoolsv.exe 3392 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe 1936 spoolsv.exe 1936 spoolsv.exe 4444 spoolsv.exe 4444 spoolsv.exe 1980 spoolsv.exe 1980 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 4944 spoolsv.exe 4944 spoolsv.exe 3012 spoolsv.exe 3012 spoolsv.exe 1052 spoolsv.exe 1052 spoolsv.exe 3844 spoolsv.exe 3844 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe 2464 spoolsv.exe 2464 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeexplorer.exedescription pid process target process PID 4000 wrote to memory of 3260 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe cmd.exe PID 4000 wrote to memory of 3260 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe cmd.exe PID 4000 wrote to memory of 3260 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe cmd.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 4000 wrote to memory of 3268 4000 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 3472 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe PID 3268 wrote to memory of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 3268 wrote to memory of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 3268 wrote to memory of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 3268 wrote to memory of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 3268 wrote to memory of 4128 3268 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe diskperf.exe PID 3472 wrote to memory of 4520 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe explorer.exe PID 3472 wrote to memory of 4520 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe explorer.exe PID 3472 wrote to memory of 4520 3472 1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe explorer.exe PID 4520 wrote to memory of 1028 4520 explorer.exe cmd.exe PID 4520 wrote to memory of 1028 4520 explorer.exe cmd.exe PID 4520 wrote to memory of 1028 4520 explorer.exe cmd.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe PID 4520 wrote to memory of 2304 4520 explorer.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1d02d54daf75df2128c2b9bb12682f2b_JaffaCakes118.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:1028 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2304 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4692 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:3008
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4288 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:1628
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2420
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3564
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3484 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 7649⤵
- Program crash
PID:3552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4576 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:676
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:5044
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:1956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:4740
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:2676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:2276
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:3412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵PID:4884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:1356
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3288 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:4652
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵PID:3176
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵PID:3908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1300 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2092 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3388 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5072 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4472 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:4136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3108 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2400 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:1656 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4656 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:3008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:3420 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:4364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:2504 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2380 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
PID:5068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:2156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2508
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1096
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4244
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3412
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1140
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3524
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1552
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4936
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:556
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:840
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 5608⤵
- Program crash
PID:1548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2656
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3564
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1992
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:5056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:4392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:3256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:2888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 5608⤵
- Program crash
PID:4248 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4244
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:4796
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:4128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 15961⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4456 -ip 44561⤵PID:2508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4824 -ip 48241⤵PID:4632
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD51d02d54daf75df2128c2b9bb12682f2b
SHA11fc242fe45d6f7fd8fa6f70c9de5cc84db062f11
SHA2569bf132141bbd8a842f487efecf12ca6a4f0bcbaae8aa578480bea2fb95c5bbaf
SHA512a17fd2af30c0c1ae276f9dc9e19a2662681a5e215e0bd6ec6d59087ce959661d353ed1bb2e1af1b6f9bc255840616f4280b6cd9d247da68a900cf86414bff7fb
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5dae7adf1ff5b25eb8355187a18141b71
SHA1a8d545d2ce04618a85498e650feeaaa8fa2e1c85
SHA256b58c29dec39260726a87117cae8923351a1db57ecb24a8821ee144339f0bbc65
SHA512efd3f643aabf37fe6b3b15dc422bb4a38025c11aaa6ba1257e839c485551ec727d8333b3c98164a51f5473f79b3ad30243e2d736f891dbc12819028b2e8535c1
-
Filesize
2.9MB
MD54ae9bc863b823fe874464e2ea2b6ed3d
SHA1c410db9d2124f8262100caa16231c9eabc6fd0b8
SHA2565de49da6f693563debc0ba7cf46e11ebb1247edb1f84980f0279af1e08f44834
SHA512503f520dbd9a3d9b4615612ea149829019f13c222b2c431bbf183920f0f6d178b45bdf217179a17bd185ecafff135c058f7c571bffbfdca609862cbc40485d5c