Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 17:36
Behavioral task
behavioral1
Sample
25f538deef72290295226c697cc2993c_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
25f538deef72290295226c697cc2993c_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
25f538deef72290295226c697cc2993c
-
SHA1
07767e7f556b686021eb0d58780f0517565595a1
-
SHA256
8984c4382cdb2c9f669c75107db3c07f3d5e557b985340e352204da935d07e02
-
SHA512
7e91823b046cfa7fef3d74df9b28710bc0ae34d24c3fff641c491a592b0fe4014c8a6b93aa13f953f97a355f93304947c2a675fb36844e969c45fd355b0bff13
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwJ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25f538deef72290295226c697cc2993c_JaffaCakes118.exe 25f538deef72290295226c697cc2993c_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\25f538deef72290295226c697cc2993c_JaffaCakes118.exe 25f538deef72290295226c697cc2993c_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4148 explorer.exe 3360 explorer.exe 4872 spoolsv.exe 348 spoolsv.exe 4636 spoolsv.exe 2520 spoolsv.exe 2104 spoolsv.exe 456 spoolsv.exe 2832 spoolsv.exe 3400 spoolsv.exe 3096 spoolsv.exe 4848 spoolsv.exe 388 spoolsv.exe 2020 spoolsv.exe 812 spoolsv.exe 2936 spoolsv.exe 3564 spoolsv.exe 2712 spoolsv.exe 4308 spoolsv.exe 1596 spoolsv.exe 1580 spoolsv.exe 3108 spoolsv.exe 2756 spoolsv.exe 4532 spoolsv.exe 1436 spoolsv.exe 1008 spoolsv.exe 3908 spoolsv.exe 4980 spoolsv.exe 2984 spoolsv.exe 5112 spoolsv.exe 4504 spoolsv.exe 3092 spoolsv.exe 3832 explorer.exe 1572 spoolsv.exe 1280 spoolsv.exe 4960 spoolsv.exe 1764 spoolsv.exe 4252 spoolsv.exe 1332 explorer.exe 3000 spoolsv.exe 1120 spoolsv.exe 4808 spoolsv.exe 4004 spoolsv.exe 3584 spoolsv.exe 3244 spoolsv.exe 4508 spoolsv.exe 3364 explorer.exe 4816 spoolsv.exe 3140 spoolsv.exe 1912 spoolsv.exe 5004 spoolsv.exe 3860 spoolsv.exe 212 spoolsv.exe 2524 explorer.exe 1656 spoolsv.exe 3764 spoolsv.exe 2928 spoolsv.exe 4900 spoolsv.exe 1020 spoolsv.exe 1824 spoolsv.exe 1208 explorer.exe 2012 spoolsv.exe 4836 spoolsv.exe 1956 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 49 IoCs
description pid Process procid_target PID 3176 set thread context of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 4148 set thread context of 3360 4148 explorer.exe 89 PID 4872 set thread context of 3092 4872 spoolsv.exe 119 PID 348 set thread context of 1572 348 spoolsv.exe 121 PID 4636 set thread context of 4960 4636 spoolsv.exe 123 PID 2520 set thread context of 1764 2520 spoolsv.exe 124 PID 2104 set thread context of 4252 2104 spoolsv.exe 125 PID 456 set thread context of 3000 456 spoolsv.exe 127 PID 2832 set thread context of 1120 2832 spoolsv.exe 128 PID 3400 set thread context of 4808 3400 spoolsv.exe 129 PID 3096 set thread context of 4004 3096 spoolsv.exe 130 PID 4848 set thread context of 3584 4848 spoolsv.exe 131 PID 388 set thread context of 4508 388 spoolsv.exe 133 PID 2020 set thread context of 4816 2020 spoolsv.exe 135 PID 812 set thread context of 3140 812 spoolsv.exe 136 PID 2936 set thread context of 1912 2936 spoolsv.exe 137 PID 3564 set thread context of 5004 3564 spoolsv.exe 138 PID 2712 set thread context of 212 2712 spoolsv.exe 140 PID 4308 set thread context of 1656 4308 spoolsv.exe 142 PID 1596 set thread context of 3764 1596 spoolsv.exe 143 PID 1580 set thread context of 2928 1580 spoolsv.exe 144 PID 3108 set thread context of 1020 3108 spoolsv.exe 146 PID 2756 set thread context of 1824 2756 spoolsv.exe 147 PID 4532 set thread context of 2012 4532 spoolsv.exe 149 PID 1436 set thread context of 4836 1436 spoolsv.exe 150 PID 1008 set thread context of 2968 1008 spoolsv.exe 152 PID 3908 set thread context of 1568 3908 spoolsv.exe 153 PID 4980 set thread context of 396 4980 spoolsv.exe 155 PID 2984 set thread context of 3516 2984 spoolsv.exe 156 PID 5112 set thread context of 5080 5112 spoolsv.exe 157 PID 4504 set thread context of 2136 4504 spoolsv.exe 160 PID 3832 set thread context of 1116 3832 explorer.exe 163 PID 1280 set thread context of 4716 1280 spoolsv.exe 168 PID 1332 set thread context of 2872 1332 explorer.exe 171 PID 3244 set thread context of 4028 3244 spoolsv.exe 179 PID 3364 set thread context of 1440 3364 explorer.exe 180 PID 3860 set thread context of 4312 3860 spoolsv.exe 184 PID 2524 set thread context of 1672 2524 explorer.exe 187 PID 4900 set thread context of 5036 4900 spoolsv.exe 190 PID 1208 set thread context of 3188 1208 explorer.exe 193 PID 1956 set thread context of 4540 1956 spoolsv.exe 196 PID 1460 set thread context of 4612 1460 explorer.exe 198 PID 2252 set thread context of 1920 2252 spoolsv.exe 200 PID 4856 set thread context of 2864 4856 spoolsv.exe 201 PID 3456 set thread context of 4144 3456 explorer.exe 204 PID 4488 set thread context of 4380 4488 spoolsv.exe 205 PID 1588 set thread context of 1400 1588 spoolsv.exe 207 PID 3844 set thread context of 4552 3844 spoolsv.exe 208 PID 2036 set thread context of 2552 2036 spoolsv.exe 210 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 25f538deef72290295226c697cc2993c_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 25f538deef72290295226c697cc2993c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3360 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3092 spoolsv.exe 3092 spoolsv.exe 1572 spoolsv.exe 1572 spoolsv.exe 4960 spoolsv.exe 4960 spoolsv.exe 1764 spoolsv.exe 1764 spoolsv.exe 4252 spoolsv.exe 4252 spoolsv.exe 3000 spoolsv.exe 3000 spoolsv.exe 1120 spoolsv.exe 1120 spoolsv.exe 4808 spoolsv.exe 4808 spoolsv.exe 4004 spoolsv.exe 4004 spoolsv.exe 3584 spoolsv.exe 3584 spoolsv.exe 4508 spoolsv.exe 4508 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 3140 spoolsv.exe 3140 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe 5004 spoolsv.exe 5004 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 1656 spoolsv.exe 1656 spoolsv.exe 3764 spoolsv.exe 3764 spoolsv.exe 2928 spoolsv.exe 2928 spoolsv.exe 1020 spoolsv.exe 1020 spoolsv.exe 1824 spoolsv.exe 1824 spoolsv.exe 2012 spoolsv.exe 2012 spoolsv.exe 4836 spoolsv.exe 4836 spoolsv.exe 2968 spoolsv.exe 2968 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 396 spoolsv.exe 396 spoolsv.exe 3516 spoolsv.exe 3516 spoolsv.exe 5080 spoolsv.exe 5080 spoolsv.exe 2136 spoolsv.exe 2136 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 656 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 80 PID 3176 wrote to memory of 656 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 80 PID 3176 wrote to memory of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 3176 wrote to memory of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 3176 wrote to memory of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 3176 wrote to memory of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 3176 wrote to memory of 1488 3176 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 85 PID 1488 wrote to memory of 4148 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 86 PID 1488 wrote to memory of 4148 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 86 PID 1488 wrote to memory of 4148 1488 25f538deef72290295226c697cc2993c_JaffaCakes118.exe 86 PID 4148 wrote to memory of 3360 4148 explorer.exe 89 PID 4148 wrote to memory of 3360 4148 explorer.exe 89 PID 4148 wrote to memory of 3360 4148 explorer.exe 89 PID 4148 wrote to memory of 3360 4148 explorer.exe 89 PID 4148 wrote to memory of 3360 4148 explorer.exe 89 PID 3360 wrote to memory of 4872 3360 explorer.exe 90 PID 3360 wrote to memory of 4872 3360 explorer.exe 90 PID 3360 wrote to memory of 4872 3360 explorer.exe 90 PID 3360 wrote to memory of 348 3360 explorer.exe 91 PID 3360 wrote to memory of 348 3360 explorer.exe 91 PID 3360 wrote to memory of 348 3360 explorer.exe 91 PID 3360 wrote to memory of 4636 3360 explorer.exe 92 PID 3360 wrote to memory of 4636 3360 explorer.exe 92 PID 3360 wrote to memory of 4636 3360 explorer.exe 92 PID 3360 wrote to memory of 2520 3360 explorer.exe 93 PID 3360 wrote to memory of 2520 3360 explorer.exe 93 PID 3360 wrote to memory of 2520 3360 explorer.exe 93 PID 3360 wrote to memory of 2104 3360 explorer.exe 94 PID 3360 wrote to memory of 2104 3360 explorer.exe 94 PID 3360 wrote to memory of 2104 3360 explorer.exe 94 PID 3360 wrote to memory of 456 3360 explorer.exe 95 PID 3360 wrote to memory of 456 3360 explorer.exe 95 PID 3360 wrote to memory of 456 3360 explorer.exe 95 PID 3360 wrote to memory of 2832 3360 explorer.exe 96 PID 3360 wrote to memory of 2832 3360 explorer.exe 96 PID 3360 wrote to memory of 2832 3360 explorer.exe 96 PID 3360 wrote to memory of 3400 3360 explorer.exe 97 PID 3360 wrote to memory of 3400 3360 explorer.exe 97 PID 3360 wrote to memory of 3400 3360 explorer.exe 97 PID 3360 wrote to memory of 3096 3360 explorer.exe 98 PID 3360 wrote to memory of 3096 3360 explorer.exe 98 PID 3360 wrote to memory of 3096 3360 explorer.exe 98 PID 3360 wrote to memory of 4848 3360 explorer.exe 99 PID 3360 wrote to memory of 4848 3360 explorer.exe 99 PID 3360 wrote to memory of 4848 3360 explorer.exe 99 PID 3360 wrote to memory of 388 3360 explorer.exe 100 PID 3360 wrote to memory of 388 3360 explorer.exe 100 PID 3360 wrote to memory of 388 3360 explorer.exe 100 PID 3360 wrote to memory of 2020 3360 explorer.exe 101 PID 3360 wrote to memory of 2020 3360 explorer.exe 101 PID 3360 wrote to memory of 2020 3360 explorer.exe 101 PID 3360 wrote to memory of 812 3360 explorer.exe 102 PID 3360 wrote to memory of 812 3360 explorer.exe 102 PID 3360 wrote to memory of 812 3360 explorer.exe 102 PID 3360 wrote to memory of 2936 3360 explorer.exe 103 PID 3360 wrote to memory of 2936 3360 explorer.exe 103 PID 3360 wrote to memory of 2936 3360 explorer.exe 103 PID 3360 wrote to memory of 3564 3360 explorer.exe 104 PID 3360 wrote to memory of 3564 3360 explorer.exe 104 PID 3360 wrote to memory of 3564 3360 explorer.exe 104 PID 3360 wrote to memory of 2712 3360 explorer.exe 105 PID 3360 wrote to memory of 2712 3360 explorer.exe 105 PID 3360 wrote to memory of 2712 3360 explorer.exe 105 PID 3360 wrote to memory of 4308 3360 explorer.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f538deef72290295226c697cc2993c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25f538deef72290295226c697cc2993c_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:656
-
-
C:\Users\Admin\AppData\Local\Temp\25f538deef72290295226c697cc2993c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25f538deef72290295226c697cc2993c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3092 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3832 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1116
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4252 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1332 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2872
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4808
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3584
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4508 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3364 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1440
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:212 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2524 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1672
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1208 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3188
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1568 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1460 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4612
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2136 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3456 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4144
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4716
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1104 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2952
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4028
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3776
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4312
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1744
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5036
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1952
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4540
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4904
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1920
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2864
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4852
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4552
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2180
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3236
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3632
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1556
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3160
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5d61543b4910ca8203e87cc6e25094f94
SHA1e2e43ffa16d86621a428eea2387520f58cba3021
SHA256b157de75c6a0dd23f22ab18b6da1ac23a28474772c0740732503d75b050a0d34
SHA5128889acce0c21f90bb287b2d7a9a4dc47791ac3ac8323b7b1e74340eea06ac54b1abf84205c4097b0f608b34a00e4b8e73b8b7b59b2f68769b8a986496e145a96
-
Filesize
2.2MB
MD54bf5cc9a8bb1c735190c5f961fa7d28e
SHA1495148f76e7b5ef0daf5ddd5c71b478e4b6a6a24
SHA2569def1926c581c0227c85cdf1b9540d92461bbd3f7b5251e621acc23836f8e503
SHA51240bea05d8bcc09a8a65436f51b1cf8951b6aa0b9fb057f6cd313ab89e39d8e81b4f3e247dd2b1fd77ab412bea3930d14e2feaed376b61470fe4711b33aa7ae14