Analysis
-
max time kernel
119s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 13:42
Behavioral task
behavioral1
Sample
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
5f6167e679f289042f10f34049d4c0ef
-
SHA1
dbafd83e0821ed76bfd9feebdf0e4d80fd01dbfc
-
SHA256
9027e8437030252f3bf55cb2e225db69d6a7458e116156abf4582f51c0cbd8aa
-
SHA512
ccc18d1dbfc352b5c3deb5d8b9346ea580f8a745477624b1d9cc38f4139791263cc5dace9ee201a9337d14b0b31e35f6a332e4285ddd760d76524dd8e08c3a28
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ4:0UzeyQMS4DqodCnoe+iitjWwwU
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe -
Executes dropped EXE 33 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 4064 explorer.exe 4872 explorer.exe 3324 spoolsv.exe 2256 spoolsv.exe 1384 spoolsv.exe 4796 spoolsv.exe 2120 spoolsv.exe 3896 spoolsv.exe 3692 spoolsv.exe 1556 spoolsv.exe 3068 spoolsv.exe 2676 spoolsv.exe 5080 spoolsv.exe 3316 spoolsv.exe 2280 spoolsv.exe 3508 spoolsv.exe 3764 spoolsv.exe 4320 explorer.exe 2276 spoolsv.exe 2304 spoolsv.exe 3484 spoolsv.exe 380 explorer.exe 1712 spoolsv.exe 2964 spoolsv.exe 5088 spoolsv.exe 3104 explorer.exe 1048 spoolsv.exe 4692 explorer.exe 828 spoolsv.exe 1532 spoolsv.exe 4116 spoolsv.exe 3096 spoolsv.exe 4428 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 3372 set thread context of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 4064 set thread context of 4872 4064 explorer.exe explorer.exe PID 3324 set thread context of 3764 3324 spoolsv.exe spoolsv.exe PID 2256 set thread context of 2276 2256 spoolsv.exe spoolsv.exe PID 1384 set thread context of 3484 1384 spoolsv.exe spoolsv.exe PID 4796 set thread context of 1712 4796 spoolsv.exe spoolsv.exe PID 2120 set thread context of 5088 2120 spoolsv.exe spoolsv.exe PID 3896 set thread context of 1048 3896 spoolsv.exe spoolsv.exe PID 3692 set thread context of 1532 3692 spoolsv.exe spoolsv.exe PID 1556 set thread context of 3096 1556 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 26 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exeexplorer.exepid process 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 4872 explorer.exe 3764 spoolsv.exe 3764 spoolsv.exe 2276 spoolsv.exe 2276 spoolsv.exe 3484 spoolsv.exe 3484 spoolsv.exe 1712 spoolsv.exe 1712 spoolsv.exe 5088 spoolsv.exe 5088 spoolsv.exe 1048 spoolsv.exe 1048 spoolsv.exe 1532 spoolsv.exe 1532 spoolsv.exe 3096 spoolsv.exe 3096 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 3372 wrote to memory of 4632 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe splwow64.exe PID 3372 wrote to memory of 4632 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe splwow64.exe PID 3372 wrote to memory of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 3372 wrote to memory of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 3372 wrote to memory of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 3372 wrote to memory of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 3372 wrote to memory of 1948 3372 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe PID 1948 wrote to memory of 4064 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 4064 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 4064 1948 5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe explorer.exe PID 4064 wrote to memory of 4872 4064 explorer.exe explorer.exe PID 4064 wrote to memory of 4872 4064 explorer.exe explorer.exe PID 4064 wrote to memory of 4872 4064 explorer.exe explorer.exe PID 4064 wrote to memory of 4872 4064 explorer.exe explorer.exe PID 4064 wrote to memory of 4872 4064 explorer.exe explorer.exe PID 4872 wrote to memory of 3324 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3324 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3324 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2256 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2256 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2256 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1384 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1384 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1384 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 4796 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 4796 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 4796 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2120 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2120 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2120 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3896 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3896 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3896 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3692 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3692 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3692 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1556 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1556 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 1556 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3068 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3068 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3068 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2676 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2676 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2676 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 5080 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 5080 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 5080 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3316 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3316 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3316 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2280 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2280 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 2280 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3508 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3508 4872 explorer.exe spoolsv.exe PID 4872 wrote to memory of 3508 4872 explorer.exe spoolsv.exe PID 3324 wrote to memory of 3764 3324 spoolsv.exe spoolsv.exe PID 3324 wrote to memory of 3764 3324 spoolsv.exe spoolsv.exe PID 3324 wrote to memory of 3764 3324 spoolsv.exe spoolsv.exe PID 3324 wrote to memory of 3764 3324 spoolsv.exe spoolsv.exe PID 3324 wrote to memory of 3764 3324 spoolsv.exe spoolsv.exe PID 3764 wrote to memory of 4320 3764 spoolsv.exe explorer.exe PID 3764 wrote to memory of 4320 3764 spoolsv.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f6167e679f289042f10f34049d4c0ef_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4320 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2276 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3484 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:380 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5088 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1048 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4692 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:4428 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:536
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3656
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2992
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3020
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4060
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2704
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2608
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2064
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:4116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3792
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4696
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:736
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:3172
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD55137af3306f1911c7deed48adfb62e72
SHA17b4d75de5655816eb21a604fa425c256baa807bd
SHA256b13b638a28460131d5d3cf8f037ac8ded8704dce2d540ef41202c3260b39e75c
SHA512efde54b3cdc43d756412c1528d94a6c7f2d8e753916d05768c4043aa7c75f0f5bd90c27e8875525720a8a6ee0b02d2484142294a5489601542e81a13d228b7e8
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5b2c1ecf50def77538dd44be0275c53f3
SHA14130a107f06fafce5e717fd982d5bbc957e35b88
SHA256375fd81b67ce67da0cc5f1e78cbb59732fda2d15b2d7871545c395f94bd03765
SHA512ed4b36e2ee401c310187b4a6726e7a95bdbc8f930b2c4c3158eee6b730b18b2c24defeab8a76b84dc2dde03c287cab166660322ea7e3a493907ccb6673002761
-
memory/536-1676-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/536-1791-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1048-1373-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1156-2615-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1156-2620-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1200-2165-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1384-1077-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1384-600-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1532-1382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1556-812-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1572-2512-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1712-1087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-80-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-78-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/1996-2403-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2064-2597-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2120-624-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-1223-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2256-525-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2256-965-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2276-969-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2280-1224-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2596-2629-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2608-2392-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-967-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2704-2155-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2704-2293-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2992-1930-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2992-1811-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3068-883-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3080-2027-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3080-2023-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3096-1660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3096-1527-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3316-1075-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3324-950-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3324-336-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3372-27-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3372-1-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3372-28-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/3372-36-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3372-0-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/3484-1076-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3484-1205-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3656-1686-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3692-811-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3764-955-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3764-1063-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3880-2609-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3896-740-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4060-1938-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4060-2079-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4064-86-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4064-81-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4080-2414-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4696-2726-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4796-601-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4796-1083-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4872-251-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4872-87-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5080-968-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5088-1358-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5088-1225-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB