Analysis
-
max time kernel
121s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 00:24
Behavioral task
behavioral1
Sample
617219e9b48079712e30b4854a119659_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
617219e9b48079712e30b4854a119659_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
617219e9b48079712e30b4854a119659
-
SHA1
a57a6afb8ea7f28613c5f250f843a2ce93ed3fd1
-
SHA256
9d03481ec0726d984db571118a9864e902c80521de06a1b94fc40aa8d4ce818d
-
SHA512
2c117bb90154451db0558aa94fcb7881bf5bf1b8e81bb2565762476ff614e4856d71f32941a7c9599fcd097864bb28d5c354d9ab0e4f926c1ca69336aae628a9
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
617219e9b48079712e30b4854a119659_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3452 explorer.exe 4724 explorer.exe 1436 spoolsv.exe 1624 spoolsv.exe 5104 spoolsv.exe 3160 spoolsv.exe 2204 spoolsv.exe 3340 spoolsv.exe 3996 spoolsv.exe 668 spoolsv.exe 2984 spoolsv.exe 4532 spoolsv.exe 2216 spoolsv.exe 868 spoolsv.exe 1072 spoolsv.exe 624 spoolsv.exe 3672 spoolsv.exe 2572 spoolsv.exe 4016 spoolsv.exe 2256 spoolsv.exe 4400 spoolsv.exe 1580 spoolsv.exe 5096 spoolsv.exe 4816 spoolsv.exe 4520 spoolsv.exe 4828 spoolsv.exe 1532 spoolsv.exe 5112 spoolsv.exe 4936 spoolsv.exe 2632 spoolsv.exe 8 spoolsv.exe 336 spoolsv.exe 4292 spoolsv.exe 4756 spoolsv.exe 4688 spoolsv.exe 4600 explorer.exe 3780 spoolsv.exe 2172 spoolsv.exe 2436 spoolsv.exe 5008 spoolsv.exe 4996 spoolsv.exe 4272 spoolsv.exe 4704 spoolsv.exe 320 spoolsv.exe 1292 explorer.exe 2060 spoolsv.exe 4780 spoolsv.exe 3852 spoolsv.exe 4792 spoolsv.exe 2096 spoolsv.exe 2556 spoolsv.exe 4964 spoolsv.exe 2104 spoolsv.exe 2280 spoolsv.exe 3532 explorer.exe 4344 spoolsv.exe 1500 spoolsv.exe 4504 spoolsv.exe 2164 spoolsv.exe 4356 explorer.exe 5048 spoolsv.exe 2736 spoolsv.exe 1860 spoolsv.exe 2140 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 36 IoCs
Processes:
617219e9b48079712e30b4854a119659_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 2392 set thread context of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 3452 set thread context of 4724 3452 explorer.exe explorer.exe PID 1436 set thread context of 4688 1436 spoolsv.exe spoolsv.exe PID 1624 set thread context of 3780 1624 spoolsv.exe spoolsv.exe PID 5104 set thread context of 2436 5104 spoolsv.exe spoolsv.exe PID 3160 set thread context of 5008 3160 spoolsv.exe spoolsv.exe PID 2204 set thread context of 4996 2204 spoolsv.exe spoolsv.exe PID 3340 set thread context of 4272 3340 spoolsv.exe spoolsv.exe PID 3996 set thread context of 4704 3996 spoolsv.exe spoolsv.exe PID 668 set thread context of 320 668 spoolsv.exe spoolsv.exe PID 2984 set thread context of 4780 2984 spoolsv.exe spoolsv.exe PID 4532 set thread context of 3852 4532 spoolsv.exe spoolsv.exe PID 2216 set thread context of 4792 2216 spoolsv.exe spoolsv.exe PID 868 set thread context of 2096 868 spoolsv.exe spoolsv.exe PID 1072 set thread context of 2556 1072 spoolsv.exe spoolsv.exe PID 624 set thread context of 4964 624 spoolsv.exe spoolsv.exe PID 3672 set thread context of 2280 3672 spoolsv.exe spoolsv.exe PID 2572 set thread context of 4344 2572 spoolsv.exe spoolsv.exe PID 4016 set thread context of 1500 4016 spoolsv.exe spoolsv.exe PID 2256 set thread context of 2164 2256 spoolsv.exe spoolsv.exe PID 4400 set thread context of 5048 4400 spoolsv.exe spoolsv.exe PID 1580 set thread context of 2736 1580 spoolsv.exe spoolsv.exe PID 5096 set thread context of 1860 5096 spoolsv.exe spoolsv.exe PID 4816 set thread context of 2548 4816 spoolsv.exe spoolsv.exe PID 4520 set thread context of 3940 4520 spoolsv.exe spoolsv.exe PID 4828 set thread context of 4352 4828 spoolsv.exe spoolsv.exe PID 1532 set thread context of 4896 1532 spoolsv.exe spoolsv.exe PID 5112 set thread context of 4804 5112 spoolsv.exe spoolsv.exe PID 4936 set thread context of 1788 4936 spoolsv.exe spoolsv.exe PID 2632 set thread context of 1596 2632 spoolsv.exe spoolsv.exe PID 8 set thread context of 2740 8 spoolsv.exe spoolsv.exe PID 336 set thread context of 2960 336 spoolsv.exe spoolsv.exe PID 4292 set thread context of 2208 4292 spoolsv.exe spoolsv.exe PID 4756 set thread context of 2848 4756 spoolsv.exe spoolsv.exe PID 4600 set thread context of 2940 4600 explorer.exe explorer.exe PID 2172 set thread context of 1992 2172 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe617219e9b48079712e30b4854a119659_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe617219e9b48079712e30b4854a119659_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 617219e9b48079712e30b4854a119659_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
617219e9b48079712e30b4854a119659_JaffaCakes118.exeexplorer.exepid process 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4724 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
617219e9b48079712e30b4854a119659_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4724 explorer.exe 4688 spoolsv.exe 4688 spoolsv.exe 3780 spoolsv.exe 3780 spoolsv.exe 2436 spoolsv.exe 2436 spoolsv.exe 5008 spoolsv.exe 5008 spoolsv.exe 4996 spoolsv.exe 4996 spoolsv.exe 4272 spoolsv.exe 4272 spoolsv.exe 4704 spoolsv.exe 4704 spoolsv.exe 320 spoolsv.exe 320 spoolsv.exe 4780 spoolsv.exe 4780 spoolsv.exe 3852 spoolsv.exe 3852 spoolsv.exe 4792 spoolsv.exe 4792 spoolsv.exe 2096 spoolsv.exe 2096 spoolsv.exe 2556 spoolsv.exe 2556 spoolsv.exe 4964 spoolsv.exe 4964 spoolsv.exe 2280 spoolsv.exe 2280 spoolsv.exe 4344 spoolsv.exe 4344 spoolsv.exe 1500 spoolsv.exe 1500 spoolsv.exe 2164 spoolsv.exe 2164 spoolsv.exe 5048 spoolsv.exe 5048 spoolsv.exe 2736 spoolsv.exe 2736 spoolsv.exe 1860 spoolsv.exe 1860 spoolsv.exe 2548 spoolsv.exe 2548 spoolsv.exe 3940 spoolsv.exe 3940 spoolsv.exe 4352 spoolsv.exe 4352 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 4804 spoolsv.exe 4804 spoolsv.exe 1788 spoolsv.exe 1788 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 2740 spoolsv.exe 2740 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
617219e9b48079712e30b4854a119659_JaffaCakes118.exe617219e9b48079712e30b4854a119659_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2392 wrote to memory of 1248 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe splwow64.exe PID 2392 wrote to memory of 1248 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe splwow64.exe PID 2392 wrote to memory of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 2392 wrote to memory of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 2392 wrote to memory of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 2392 wrote to memory of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 2392 wrote to memory of 3932 2392 617219e9b48079712e30b4854a119659_JaffaCakes118.exe 617219e9b48079712e30b4854a119659_JaffaCakes118.exe PID 3932 wrote to memory of 3452 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe explorer.exe PID 3932 wrote to memory of 3452 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe explorer.exe PID 3932 wrote to memory of 3452 3932 617219e9b48079712e30b4854a119659_JaffaCakes118.exe explorer.exe PID 3452 wrote to memory of 4724 3452 explorer.exe explorer.exe PID 3452 wrote to memory of 4724 3452 explorer.exe explorer.exe PID 3452 wrote to memory of 4724 3452 explorer.exe explorer.exe PID 3452 wrote to memory of 4724 3452 explorer.exe explorer.exe PID 3452 wrote to memory of 4724 3452 explorer.exe explorer.exe PID 4724 wrote to memory of 1436 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1436 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1436 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 5104 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 5104 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 5104 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3160 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3160 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3160 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2204 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2204 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2204 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3340 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3340 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3340 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3996 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3996 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3996 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 668 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 668 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 668 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2984 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2984 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2984 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 4532 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 4532 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 4532 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2216 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2216 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2216 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 868 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 868 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 868 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1072 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1072 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 1072 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 624 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3672 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3672 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 3672 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2572 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2572 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 2572 4724 explorer.exe spoolsv.exe PID 4724 wrote to memory of 4016 4724 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\617219e9b48079712e30b4854a119659_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\617219e9b48079712e30b4854a119659_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\617219e9b48079712e30b4854a119659_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\617219e9b48079712e30b4854a119659_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5fba2337932e9febd22691df879cee961
SHA10f8290fa8e4ff80e5e9ec7e4c747a267b1adf346
SHA256626c7159151b200bbd2a69dc8f8c2ad7f4baccfb4539d90550f92ddba5e17111
SHA5125bc851734e0f1adb985cbaf740b820b5ab78067c8df5a3a44d49a2e57f3b0613f7729cc4cbf5f6cba49a330a5f1f8e28bde19d41b37749eb2c3bb00addc5e246
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD50e6ca6505f24f22b5580ff520b690f97
SHA170e2fff2a45dedb35413474d48b4a9b10e489dde
SHA256a18f9920d3d3d0e87cd089e10cc52cf8e4dcca1bd28920d87823951498f0f3c0
SHA5122d2b3f971e2e991da45475c97dc50f06d29aaa50af415f11d516b6b07cc54e928a06b2ac4c9dcf8a682d18aecdb7266549b7e7fb317ad7580f2fd61557687821
-
memory/320-2448-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/320-2671-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-1915-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/668-1524-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/868-1735-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1000-5569-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1072-1736-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1436-2229-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1436-942-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1500-2735-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1500-2739-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1580-2226-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1596-3205-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1624-2240-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1624-1133-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1728-5395-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1788-3139-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1832-5342-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1860-2979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1992-4032-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1992-4207-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2096-2563-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2112-5664-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2164-3065-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2164-2903-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2204-1336-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2208-3559-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2216-1734-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2224-5536-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2256-2122-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2280-2720-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2280-2806-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2392-0-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/2392-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2392-43-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/2392-48-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2436-2313-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-3093-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-3252-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2556-2574-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2556-2572-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2572-1917-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2736-2923-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2740-3269-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2848-3761-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2848-3654-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2940-4026-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2984-1525-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3160-1135-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3340-1337-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3344-5457-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3452-99-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3452-94-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3588-5035-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3588-4906-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-1916-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3772-5255-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3780-2237-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3780-2235-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/3852-2539-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3932-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3932-83-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3932-47-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3996-1338-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4016-2121-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4272-2348-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4352-3108-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4400-2123-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4520-2318-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4532-1526-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4688-2228-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-2359-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-2388-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4724-941-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4724-98-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4780-2532-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4780-2527-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4792-2550-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4792-2552-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4804-3128-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4816-2239-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4896-3120-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4964-2631-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4996-2336-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4996-2340-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5008-2329-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5008-2325-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5048-2913-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5096-2227-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5104-1134-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5104-2314-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5108-5372-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5136-5374-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5372-5331-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5372-5504-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5456-4668-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5464-5180-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5464-5293-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5484-4793-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5484-4675-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5712-4593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5712-4477-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5720-5383-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5768-4962-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5812-4506-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5948-5644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5952-5415-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6044-5423-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6044-5427-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6084-5673-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB