Analysis
-
max time kernel
71s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:59
Behavioral task
behavioral1
Sample
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
65ee7ea6a1e5819898d1083721218dca
-
SHA1
2664a2c491edf1d81e3cd327809b8a1d05360e78
-
SHA256
2b56959025aa9e613a47ebb0bbbf5a33afee3e1435acc3218838720b17d1ee94
-
SHA512
951bb7253d337ce4be7fae8e58973b945fd3476c8ee951c8ecdd273decb90cd6325b49384debd9cf6c1b1ab94d273941d033ff0b5ecf62ede73cf0deaa0670cb
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl6:86SIROiFJiwp0xlrl6
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2540 explorer.exe 2104 explorer.exe 2168 explorer.exe 304 spoolsv.exe 544 spoolsv.exe 1908 spoolsv.exe 2220 spoolsv.exe 2652 spoolsv.exe 584 spoolsv.exe 1796 spoolsv.exe 2548 spoolsv.exe 1852 spoolsv.exe 2864 spoolsv.exe 1544 spoolsv.exe 2580 spoolsv.exe 2380 spoolsv.exe 2644 spoolsv.exe 1984 spoolsv.exe 2456 spoolsv.exe 2360 spoolsv.exe 2024 spoolsv.exe 1648 spoolsv.exe 2324 spoolsv.exe 2296 spoolsv.exe 1844 spoolsv.exe 1728 spoolsv.exe 1588 spoolsv.exe 1924 spoolsv.exe 2432 spoolsv.exe 2212 spoolsv.exe 2100 spoolsv.exe 1544 spoolsv.exe 2608 spoolsv.exe 2532 spoolsv.exe 2772 spoolsv.exe 2812 spoolsv.exe 760 spoolsv.exe 1676 spoolsv.exe 768 spoolsv.exe 2844 spoolsv.exe 1508 spoolsv.exe 940 spoolsv.exe 2860 spoolsv.exe 976 spoolsv.exe 880 spoolsv.exe 2612 spoolsv.exe 3012 spoolsv.exe 2712 spoolsv.exe 2920 spoolsv.exe 1984 spoolsv.exe 2012 spoolsv.exe 1952 spoolsv.exe 1492 spoolsv.exe 3024 spoolsv.exe 2760 spoolsv.exe 2924 spoolsv.exe 1104 spoolsv.exe 1912 spoolsv.exe 324 spoolsv.exe 1852 spoolsv.exe 1568 spoolsv.exe 2504 spoolsv.exe 1972 spoolsv.exe 2128 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2168 explorer.exe 2168 explorer.exe 304 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1908 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2652 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1796 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1852 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1544 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2380 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1984 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2360 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1648 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2296 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1728 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1924 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2212 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1544 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2532 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2812 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1676 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 2844 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 940 spoolsv.exe 2168 explorer.exe 2168 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1424 set thread context of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 set thread context of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 2540 set thread context of 2104 2540 explorer.exe explorer.exe PID 2104 set thread context of 2168 2104 explorer.exe explorer.exe PID 304 set thread context of 544 304 spoolsv.exe spoolsv.exe PID 1908 set thread context of 2220 1908 spoolsv.exe spoolsv.exe PID 2652 set thread context of 584 2652 spoolsv.exe spoolsv.exe PID 1796 set thread context of 2548 1796 spoolsv.exe spoolsv.exe PID 1852 set thread context of 2864 1852 spoolsv.exe spoolsv.exe PID 1544 set thread context of 2580 1544 spoolsv.exe spoolsv.exe PID 2380 set thread context of 2644 2380 spoolsv.exe spoolsv.exe PID 1984 set thread context of 2456 1984 spoolsv.exe spoolsv.exe PID 2360 set thread context of 2024 2360 spoolsv.exe spoolsv.exe PID 1648 set thread context of 2324 1648 spoolsv.exe spoolsv.exe PID 2296 set thread context of 1844 2296 spoolsv.exe spoolsv.exe PID 1728 set thread context of 1588 1728 spoolsv.exe spoolsv.exe PID 1924 set thread context of 2432 1924 spoolsv.exe spoolsv.exe PID 2212 set thread context of 2100 2212 spoolsv.exe spoolsv.exe PID 1544 set thread context of 2608 1544 spoolsv.exe spoolsv.exe PID 2532 set thread context of 2772 2532 spoolsv.exe spoolsv.exe PID 2812 set thread context of 760 2812 spoolsv.exe spoolsv.exe PID 1676 set thread context of 768 1676 spoolsv.exe spoolsv.exe PID 2844 set thread context of 1508 2844 spoolsv.exe spoolsv.exe PID 940 set thread context of 2860 940 spoolsv.exe spoolsv.exe PID 976 set thread context of 880 976 spoolsv.exe spoolsv.exe PID 2612 set thread context of 3012 2612 spoolsv.exe spoolsv.exe PID 2712 set thread context of 2920 2712 spoolsv.exe spoolsv.exe PID 1984 set thread context of 2012 1984 spoolsv.exe spoolsv.exe PID 1952 set thread context of 1492 1952 spoolsv.exe spoolsv.exe PID 3024 set thread context of 2760 3024 spoolsv.exe spoolsv.exe PID 2924 set thread context of 1104 2924 spoolsv.exe spoolsv.exe PID 1912 set thread context of 324 1912 spoolsv.exe spoolsv.exe PID 1852 set thread context of 1568 1852 spoolsv.exe spoolsv.exe PID 2504 set thread context of 1972 2504 spoolsv.exe spoolsv.exe PID 2128 set thread context of 2512 2128 spoolsv.exe spoolsv.exe PID 2396 set thread context of 2812 2396 spoolsv.exe spoolsv.exe PID 2268 set thread context of 2264 2268 spoolsv.exe spoolsv.exe PID 1156 set thread context of 1672 1156 spoolsv.exe spoolsv.exe PID 1812 set thread context of 1732 1812 spoolsv.exe spoolsv.exe PID 2748 set thread context of 2964 2748 spoolsv.exe spoolsv.exe PID 2412 set thread context of 2840 2412 spoolsv.exe spoolsv.exe PID 1300 set thread context of 988 1300 spoolsv.exe spoolsv.exe PID 2228 set thread context of 2596 2228 spoolsv.exe spoolsv.exe PID 2304 set thread context of 940 2304 spoolsv.exe spoolsv.exe PID 864 set thread context of 2188 864 spoolsv.exe spoolsv.exe PID 2748 set thread context of 2912 2748 spoolsv.exe spoolsv.exe PID 1996 set thread context of 2396 1996 spoolsv.exe spoolsv.exe PID 2240 set thread context of 2420 2240 spoolsv.exe spoolsv.exe PID 2836 set thread context of 2544 2836 spoolsv.exe spoolsv.exe PID 2388 set thread context of 2796 2388 spoolsv.exe spoolsv.exe PID 1044 set thread context of 1804 1044 spoolsv.exe spoolsv.exe PID 1472 set thread context of 2224 1472 spoolsv.exe spoolsv.exe PID 2092 set thread context of 2436 2092 spoolsv.exe spoolsv.exe PID 1572 set thread context of 2384 1572 spoolsv.exe spoolsv.exe PID 468 set thread context of 1300 468 spoolsv.exe spoolsv.exe PID 1480 set thread context of 648 1480 spoolsv.exe spoolsv.exe PID 1364 set thread context of 2836 1364 spoolsv.exe spoolsv.exe PID 2592 set thread context of 872 2592 spoolsv.exe spoolsv.exe PID 1388 set thread context of 1652 1388 spoolsv.exe spoolsv.exe PID 1856 set thread context of 552 1856 spoolsv.exe spoolsv.exe PID 2880 set thread context of 2592 2880 spoolsv.exe spoolsv.exe PID 3008 set thread context of 1472 3008 spoolsv.exe spoolsv.exe PID 2980 set thread context of 2180 2980 spoolsv.exe spoolsv.exe PID 1208 set thread context of 2236 1208 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exe65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exeexplorer.exepid process 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe 2168 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2168 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 2540 explorer.exe 2168 explorer.exe 2168 explorer.exe 304 spoolsv.exe 2168 explorer.exe 2168 explorer.exe 1908 spoolsv.exe 2652 spoolsv.exe 1796 spoolsv.exe 1852 spoolsv.exe 1544 spoolsv.exe 2380 spoolsv.exe 1984 spoolsv.exe 2360 spoolsv.exe 1648 spoolsv.exe 2296 spoolsv.exe 1728 spoolsv.exe 1924 spoolsv.exe 2212 spoolsv.exe 1544 spoolsv.exe 2532 spoolsv.exe 2812 spoolsv.exe 1676 spoolsv.exe 2844 spoolsv.exe 940 spoolsv.exe 976 spoolsv.exe 2612 spoolsv.exe 2712 spoolsv.exe 1984 spoolsv.exe 1952 spoolsv.exe 3024 spoolsv.exe 2924 spoolsv.exe 1912 spoolsv.exe 1852 spoolsv.exe 2504 spoolsv.exe 2128 spoolsv.exe 2396 spoolsv.exe 2268 spoolsv.exe 1156 spoolsv.exe 1812 spoolsv.exe 2748 spoolsv.exe 2412 spoolsv.exe 1300 spoolsv.exe 2228 spoolsv.exe 2304 spoolsv.exe 864 spoolsv.exe 2748 spoolsv.exe 1996 spoolsv.exe 2240 spoolsv.exe 2836 spoolsv.exe 2388 spoolsv.exe 1044 spoolsv.exe 1472 spoolsv.exe 2092 spoolsv.exe 1572 spoolsv.exe 468 spoolsv.exe 1480 spoolsv.exe 1364 spoolsv.exe 2592 spoolsv.exe 1388 spoolsv.exe 1856 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exedescription pid process target process PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1424 wrote to memory of 1608 1424 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 844 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe splwow64.exe PID 1608 wrote to memory of 844 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe splwow64.exe PID 1608 wrote to memory of 844 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe splwow64.exe PID 1608 wrote to memory of 844 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe splwow64.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 1608 wrote to memory of 2556 1608 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe PID 2556 wrote to memory of 2540 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe explorer.exe PID 2556 wrote to memory of 2540 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe explorer.exe PID 2556 wrote to memory of 2540 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe explorer.exe PID 2556 wrote to memory of 2540 2556 65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2540 wrote to memory of 2104 2540 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2104 wrote to memory of 2168 2104 explorer.exe explorer.exe PID 2168 wrote to memory of 304 2168 explorer.exe spoolsv.exe PID 2168 wrote to memory of 304 2168 explorer.exe spoolsv.exe PID 2168 wrote to memory of 304 2168 explorer.exe spoolsv.exe PID 2168 wrote to memory of 304 2168 explorer.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe PID 304 wrote to memory of 544 304 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ee7ea6a1e5819898d1083721218dca_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
\Windows\system\explorer.exeFilesize
2.6MB
MD51ecbb3d74f867c2c3b0fcd54c96878af
SHA1b83336f2bdda9c877ef61444b58c47a166f6eb47
SHA256c7cb1ddd234230466d1bb298457226a825514d73b5abf7805313b1e5e5f1b484
SHA512a62677818aa81b04066a2c23e669ea2fa83fc48bc18ba678ad486b3988d9cad9ea0af2e6e63e717f3acb9da84c2c6e177f4070676420999e5c62a66758b88393
-
\Windows\system\spoolsv.exeFilesize
2.6MB
MD52bac054bc3a7bc15e764f116f6b0208e
SHA1c0f7a313f18ca70db6fb9367cc9c0f671df4cd45
SHA256b65882278ca5ee975c8fdbb7d59b8320bd08aea1d5e0e952a14fc9be8e9ea04a
SHA512ccbc6f427df99b46e20bad4f7a92489ebd7e69ed191458f69942da6d6e7c8f910ad019eedd1250d212efc16918e011589c21566b7a60b19727686e8efffdb51c
-
memory/544-106-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1424-2-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/1608-24-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-3-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-4-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-34-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-5-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-7-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1608-6-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2104-77-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2104-56-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2104-60-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2104-87-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2540-51-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2540-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2556-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2556-59-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2556-33-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2556-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2556-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5416-6529-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5596-6551-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5596-6593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6048-6493-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB