Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 16:03
Behavioral task
behavioral1
Sample
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
63e4623a155c81cd49f0b25ae029bee9
-
SHA1
710e03ae368be2c47bca3f52b5c7aa6e71a9c9c2
-
SHA256
9fbb0b0fc9fa43defb985665b4cde0b93f327a45e316d21385645360965f921f
-
SHA512
9a1efc5ac811768a78349379e0919d4a1538ad581223b4f93d257194e3eeaafab77fc34665d412c1510e4c97d9d686ffee9952d42dca3b3d57e90920b19e1f81
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwB
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2036 explorer.exe 4480 explorer.exe 1128 spoolsv.exe 4264 spoolsv.exe 1388 spoolsv.exe 4084 spoolsv.exe 3704 spoolsv.exe 4756 spoolsv.exe 1776 spoolsv.exe 2112 spoolsv.exe 716 spoolsv.exe 4244 spoolsv.exe 3132 spoolsv.exe 4792 spoolsv.exe 4392 spoolsv.exe 4596 spoolsv.exe 2372 spoolsv.exe 2684 spoolsv.exe 348 spoolsv.exe 3864 spoolsv.exe 3672 spoolsv.exe 1016 spoolsv.exe 4600 spoolsv.exe 1752 spoolsv.exe 3584 spoolsv.exe 2884 spoolsv.exe 3076 spoolsv.exe 4516 spoolsv.exe 1348 spoolsv.exe 4972 spoolsv.exe 3140 spoolsv.exe 1548 spoolsv.exe 2116 explorer.exe 2256 spoolsv.exe 452 spoolsv.exe 3608 spoolsv.exe 888 spoolsv.exe 4572 explorer.exe 4636 spoolsv.exe 4816 spoolsv.exe 3544 spoolsv.exe 4856 spoolsv.exe 4460 spoolsv.exe 3164 spoolsv.exe 2224 spoolsv.exe 2204 spoolsv.exe 4940 explorer.exe 1136 spoolsv.exe 4068 spoolsv.exe 1040 spoolsv.exe 2840 spoolsv.exe 4044 explorer.exe 4928 spoolsv.exe 3716 spoolsv.exe 2948 spoolsv.exe 4428 spoolsv.exe 4968 spoolsv.exe 4336 explorer.exe 2212 spoolsv.exe 2232 spoolsv.exe 1172 spoolsv.exe 4956 spoolsv.exe 5080 spoolsv.exe 4872 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 41 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 3420 set thread context of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 2036 set thread context of 4480 2036 explorer.exe explorer.exe PID 1128 set thread context of 1548 1128 spoolsv.exe spoolsv.exe PID 4264 set thread context of 452 4264 spoolsv.exe spoolsv.exe PID 1388 set thread context of 3608 1388 spoolsv.exe spoolsv.exe PID 4084 set thread context of 888 4084 spoolsv.exe spoolsv.exe PID 3704 set thread context of 4636 3704 spoolsv.exe spoolsv.exe PID 4756 set thread context of 3544 4756 spoolsv.exe spoolsv.exe PID 1776 set thread context of 4856 1776 spoolsv.exe spoolsv.exe PID 2112 set thread context of 4460 2112 spoolsv.exe spoolsv.exe PID 716 set thread context of 3164 716 spoolsv.exe spoolsv.exe PID 4244 set thread context of 2204 4244 spoolsv.exe spoolsv.exe PID 3132 set thread context of 1136 3132 spoolsv.exe spoolsv.exe PID 4792 set thread context of 4068 4792 spoolsv.exe spoolsv.exe PID 4392 set thread context of 2840 4392 spoolsv.exe spoolsv.exe PID 4596 set thread context of 4928 4596 spoolsv.exe spoolsv.exe PID 2372 set thread context of 3716 2372 spoolsv.exe spoolsv.exe PID 2684 set thread context of 2948 2684 spoolsv.exe spoolsv.exe PID 348 set thread context of 4968 348 spoolsv.exe spoolsv.exe PID 3864 set thread context of 2212 3864 spoolsv.exe spoolsv.exe PID 3672 set thread context of 2232 3672 spoolsv.exe spoolsv.exe PID 1016 set thread context of 1172 1016 spoolsv.exe spoolsv.exe PID 4600 set thread context of 4956 4600 spoolsv.exe spoolsv.exe PID 1752 set thread context of 4872 1752 spoolsv.exe spoolsv.exe PID 3584 set thread context of 856 3584 spoolsv.exe spoolsv.exe PID 2884 set thread context of 4796 2884 spoolsv.exe spoolsv.exe PID 3076 set thread context of 3652 3076 spoolsv.exe spoolsv.exe PID 4516 set thread context of 4736 4516 spoolsv.exe spoolsv.exe PID 1348 set thread context of 3640 1348 spoolsv.exe spoolsv.exe PID 4972 set thread context of 912 4972 spoolsv.exe spoolsv.exe PID 3140 set thread context of 968 3140 spoolsv.exe spoolsv.exe PID 2116 set thread context of 1404 2116 explorer.exe explorer.exe PID 2256 set thread context of 640 2256 spoolsv.exe spoolsv.exe PID 4572 set thread context of 1456 4572 explorer.exe explorer.exe PID 4816 set thread context of 3448 4816 spoolsv.exe spoolsv.exe PID 2224 set thread context of 5816 2224 spoolsv.exe spoolsv.exe PID 4940 set thread context of 5900 4940 explorer.exe explorer.exe PID 4044 set thread context of 5324 4044 explorer.exe explorer.exe PID 1040 set thread context of 5432 1040 spoolsv.exe spoolsv.exe PID 4428 set thread context of 1900 4428 spoolsv.exe spoolsv.exe PID 4336 set thread context of 2996 4336 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exepid process 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4480 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 4480 explorer.exe 1548 spoolsv.exe 1548 spoolsv.exe 452 spoolsv.exe 452 spoolsv.exe 3608 spoolsv.exe 3608 spoolsv.exe 888 spoolsv.exe 888 spoolsv.exe 4636 spoolsv.exe 4636 spoolsv.exe 3544 spoolsv.exe 3544 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 4460 spoolsv.exe 4460 spoolsv.exe 3164 spoolsv.exe 3164 spoolsv.exe 2204 spoolsv.exe 2204 spoolsv.exe 1136 spoolsv.exe 1136 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 2840 spoolsv.exe 2840 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 3716 spoolsv.exe 3716 spoolsv.exe 2948 spoolsv.exe 2948 spoolsv.exe 4968 spoolsv.exe 4968 spoolsv.exe 2212 spoolsv.exe 2212 spoolsv.exe 2232 spoolsv.exe 2232 spoolsv.exe 1172 spoolsv.exe 1172 spoolsv.exe 4956 spoolsv.exe 4956 spoolsv.exe 4872 spoolsv.exe 4872 spoolsv.exe 856 spoolsv.exe 856 spoolsv.exe 4796 spoolsv.exe 4796 spoolsv.exe 3652 spoolsv.exe 3652 spoolsv.exe 4736 spoolsv.exe 4736 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 912 spoolsv.exe 912 spoolsv.exe 968 spoolsv.exe 968 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3420 wrote to memory of 3604 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 3420 wrote to memory of 3604 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe splwow64.exe PID 3420 wrote to memory of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 3420 wrote to memory of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 3420 wrote to memory of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 3420 wrote to memory of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 3420 wrote to memory of 4556 3420 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe PID 4556 wrote to memory of 2036 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 4556 wrote to memory of 2036 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 4556 wrote to memory of 2036 4556 63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe explorer.exe PID 2036 wrote to memory of 4480 2036 explorer.exe explorer.exe PID 2036 wrote to memory of 4480 2036 explorer.exe explorer.exe PID 2036 wrote to memory of 4480 2036 explorer.exe explorer.exe PID 2036 wrote to memory of 4480 2036 explorer.exe explorer.exe PID 2036 wrote to memory of 4480 2036 explorer.exe explorer.exe PID 4480 wrote to memory of 1128 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1128 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1128 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4264 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4264 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4264 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1388 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1388 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1388 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4084 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4084 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4084 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3704 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3704 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3704 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4756 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4756 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4756 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1776 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1776 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 1776 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2112 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2112 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2112 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 716 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 716 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 716 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4244 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4244 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4244 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3132 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3132 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 3132 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4792 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4792 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4792 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4392 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4392 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4392 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4596 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4596 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 4596 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2372 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2372 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2372 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2684 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2684 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 2684 4480 explorer.exe spoolsv.exe PID 4480 wrote to memory of 348 4480 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63e4623a155c81cd49f0b25ae029bee9_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD57696594ec87bf910f50a1f7e9d492564
SHA120b54e27ddf2ff68432655d4d3ca9a789248fce3
SHA256c574a8b53fa0c775f53208d9f414ee2c9afc9816bb81c592968f869c4d064a1a
SHA512af446c3b7819953d6a2becc9694c4b830dd88104ec815c3a128f0c5437247dfa18276a83cdc191bab7cf12ae16d325b1660d577c3f9704d51eff716c7989b314
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD59fa1bfcff5b137a7f8c97d04735e9d1b
SHA1b5aec69404ce0383b969a836962a83c27d5c98a5
SHA256c098e0486b31b916c804767f4a1f3aa2b7a9f57a1db9cdc8c6801def73d829e2
SHA512b9bba5f299e2e92951043a31fe6e6a0b5494b265cda5833e15518b9084d219a30899f865d1a3666437ee1bacd4aaa9bdcd523c2e04b2927f9cb434b4b38f6ed5
-
memory/348-1870-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/452-1968-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/540-5035-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/640-3372-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/716-1252-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/856-2808-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/888-2230-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/888-2037-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/912-2973-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/912-3087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/968-2981-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/968-2984-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1016-1967-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1028-4800-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1128-808-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1128-1874-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1136-2337-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1172-2649-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1388-952-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1388-1977-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1404-3241-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1456-3571-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1548-1873-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1548-2029-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1752-2036-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1776-1250-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1900-4569-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1900-4474-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2036-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2036-90-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2112-1251-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2204-2328-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2232-2641-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2372-1785-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2684-1786-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2840-2498-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-5230-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2996-4482-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2996-4486-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3132-1441-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3164-2194-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3420-0-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/3420-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3420-47-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3420-43-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/3420-4920-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3448-3709-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3544-2164-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3608-1979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3640-2841-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3652-2824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-1872-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3704-1119-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3716-2517-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3864-1871-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4068-2350-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4084-953-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4244-1440-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4264-951-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4264-1970-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4392-1611-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4400-4643-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4400-4641-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4416-5207-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4416-5017-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4460-2184-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4480-807-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4480-89-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-77-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4556-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-46-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4556-79-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4596-1612-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4600-1978-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4636-2056-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4736-2834-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4756-1120-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4792-1610-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4796-2817-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4856-2176-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4872-2740-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4928-2507-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4956-2660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4968-2774-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4968-2623-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5324-4158-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5356-4918-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5356-4790-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5432-4276-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5440-5043-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5440-5045-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5592-4629-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5688-5239-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5816-3801-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5816-3918-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5892-5248-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5900-3810-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB