Analysis
-
max time kernel
130s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 07:48
Behavioral task
behavioral1
Sample
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
6a3e26d18d3300e4251f065a6d82bb45
-
SHA1
d3a3ac09a78acec27373f1c7cce5d2aa2bfecb16
-
SHA256
5aba1a59d42a67e660bf4200acd9acab7703b63708f32d63607b85fe8e80692b
-
SHA512
1b14a819aad9b1836e8ebbc52efdabfdb4fd6dd6e9c2222b654d614dad1aba609998e28f8c4907d015ed7822188f2099c5fe91bd65d9a39545df059333127490
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwws
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 4764 explorer.exe 472 explorer.exe 2120 spoolsv.exe 3408 spoolsv.exe 3572 spoolsv.exe 2560 spoolsv.exe 848 spoolsv.exe 3796 spoolsv.exe 4372 spoolsv.exe 2712 spoolsv.exe 2292 spoolsv.exe 1544 spoolsv.exe 4432 spoolsv.exe 4400 spoolsv.exe 4960 spoolsv.exe 3756 spoolsv.exe 4108 spoolsv.exe 2912 spoolsv.exe 2148 spoolsv.exe 4340 spoolsv.exe 3100 spoolsv.exe 4360 spoolsv.exe 2688 spoolsv.exe 1928 spoolsv.exe 3804 spoolsv.exe 4764 spoolsv.exe 1508 spoolsv.exe 1556 spoolsv.exe 3568 spoolsv.exe 1244 spoolsv.exe 5036 spoolsv.exe 3092 spoolsv.exe 3264 spoolsv.exe 1116 spoolsv.exe 2592 spoolsv.exe 3856 spoolsv.exe 4284 spoolsv.exe 3108 explorer.exe 1312 spoolsv.exe 5152 spoolsv.exe 5276 spoolsv.exe 5616 spoolsv.exe 5660 explorer.exe 5992 spoolsv.exe 6080 spoolsv.exe 5260 spoolsv.exe 5284 explorer.exe 5568 spoolsv.exe 1492 spoolsv.exe 5748 spoolsv.exe 5820 spoolsv.exe 5872 spoolsv.exe 5124 spoolsv.exe 5200 explorer.exe 5460 spoolsv.exe 5476 spoolsv.exe 5544 spoolsv.exe 4068 spoolsv.exe 688 spoolsv.exe 5788 spoolsv.exe 5840 spoolsv.exe 2080 spoolsv.exe 3652 explorer.exe 5256 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 46 IoCs
Processes:
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 1564 set thread context of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 4764 set thread context of 472 4764 explorer.exe explorer.exe PID 2120 set thread context of 4284 2120 spoolsv.exe spoolsv.exe PID 3408 set thread context of 1312 3408 spoolsv.exe spoolsv.exe PID 3572 set thread context of 5276 3572 spoolsv.exe spoolsv.exe PID 2560 set thread context of 5616 2560 spoolsv.exe spoolsv.exe PID 848 set thread context of 6080 848 spoolsv.exe spoolsv.exe PID 3796 set thread context of 5260 3796 spoolsv.exe spoolsv.exe PID 4372 set thread context of 1492 4372 spoolsv.exe spoolsv.exe PID 2712 set thread context of 5748 2712 spoolsv.exe spoolsv.exe PID 2292 set thread context of 5820 2292 spoolsv.exe spoolsv.exe PID 1544 set thread context of 5872 1544 spoolsv.exe spoolsv.exe PID 4432 set thread context of 5124 4432 spoolsv.exe spoolsv.exe PID 4400 set thread context of 5476 4400 spoolsv.exe spoolsv.exe PID 4960 set thread context of 5544 4960 spoolsv.exe spoolsv.exe PID 3756 set thread context of 4068 3756 spoolsv.exe spoolsv.exe PID 4108 set thread context of 688 4108 spoolsv.exe spoolsv.exe PID 2912 set thread context of 5788 2912 spoolsv.exe spoolsv.exe PID 2148 set thread context of 5840 2148 spoolsv.exe spoolsv.exe PID 4340 set thread context of 2080 4340 spoolsv.exe spoolsv.exe PID 3100 set thread context of 224 3100 spoolsv.exe spoolsv.exe PID 4360 set thread context of 5444 4360 spoolsv.exe spoolsv.exe PID 2688 set thread context of 5504 2688 spoolsv.exe spoolsv.exe PID 1928 set thread context of 4376 1928 spoolsv.exe spoolsv.exe PID 3804 set thread context of 5576 3804 spoolsv.exe spoolsv.exe PID 4764 set thread context of 2040 4764 spoolsv.exe spoolsv.exe PID 1508 set thread context of 1052 1508 spoolsv.exe spoolsv.exe PID 1556 set thread context of 1428 1556 spoolsv.exe spoolsv.exe PID 3568 set thread context of 5404 3568 spoolsv.exe spoolsv.exe PID 1244 set thread context of 2544 1244 spoolsv.exe spoolsv.exe PID 5036 set thread context of 2484 5036 spoolsv.exe spoolsv.exe PID 3092 set thread context of 3184 3092 spoolsv.exe spoolsv.exe PID 3264 set thread context of 4112 3264 spoolsv.exe spoolsv.exe PID 1116 set thread context of 1820 1116 spoolsv.exe spoolsv.exe PID 2592 set thread context of 1924 2592 spoolsv.exe spoolsv.exe PID 3856 set thread context of 2232 3856 spoolsv.exe spoolsv.exe PID 3108 set thread context of 5924 3108 explorer.exe explorer.exe PID 5152 set thread context of 520 5152 spoolsv.exe spoolsv.exe PID 5660 set thread context of 5248 5660 explorer.exe explorer.exe PID 5992 set thread context of 2352 5992 spoolsv.exe spoolsv.exe PID 5284 set thread context of 4104 5284 explorer.exe explorer.exe PID 5568 set thread context of 2776 5568 spoolsv.exe spoolsv.exe PID 5200 set thread context of 4224 5200 explorer.exe explorer.exe PID 5460 set thread context of 4792 5460 spoolsv.exe spoolsv.exe PID 5256 set thread context of 5164 5256 spoolsv.exe spoolsv.exe PID 3652 set thread context of 3576 3652 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exe6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exeexplorer.exepid process 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 472 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 472 explorer.exe 4284 spoolsv.exe 4284 spoolsv.exe 1312 spoolsv.exe 1312 spoolsv.exe 5276 spoolsv.exe 5276 spoolsv.exe 5616 spoolsv.exe 5616 spoolsv.exe 6080 spoolsv.exe 6080 spoolsv.exe 5260 spoolsv.exe 5260 spoolsv.exe 1492 spoolsv.exe 1492 spoolsv.exe 5748 spoolsv.exe 5748 spoolsv.exe 5820 spoolsv.exe 5820 spoolsv.exe 5872 spoolsv.exe 5872 spoolsv.exe 5124 spoolsv.exe 5124 spoolsv.exe 5476 spoolsv.exe 5476 spoolsv.exe 5544 spoolsv.exe 5544 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 688 spoolsv.exe 688 spoolsv.exe 5788 spoolsv.exe 5788 spoolsv.exe 5840 spoolsv.exe 5840 spoolsv.exe 2080 spoolsv.exe 2080 spoolsv.exe 224 spoolsv.exe 224 spoolsv.exe 5444 spoolsv.exe 5444 spoolsv.exe 5504 spoolsv.exe 5504 spoolsv.exe 4376 spoolsv.exe 4376 spoolsv.exe 5576 spoolsv.exe 5576 spoolsv.exe 2040 spoolsv.exe 2040 spoolsv.exe 1052 spoolsv.exe 1052 spoolsv.exe 1428 spoolsv.exe 1428 spoolsv.exe 5404 spoolsv.exe 5404 spoolsv.exe 2544 spoolsv.exe 2544 spoolsv.exe 2484 spoolsv.exe 2484 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1564 wrote to memory of 4352 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe splwow64.exe PID 1564 wrote to memory of 4352 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe splwow64.exe PID 1564 wrote to memory of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 1564 wrote to memory of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 1564 wrote to memory of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 1564 wrote to memory of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 1564 wrote to memory of 4544 1564 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe PID 4544 wrote to memory of 4764 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe explorer.exe PID 4544 wrote to memory of 4764 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe explorer.exe PID 4544 wrote to memory of 4764 4544 6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe explorer.exe PID 4764 wrote to memory of 472 4764 explorer.exe explorer.exe PID 4764 wrote to memory of 472 4764 explorer.exe explorer.exe PID 4764 wrote to memory of 472 4764 explorer.exe explorer.exe PID 4764 wrote to memory of 472 4764 explorer.exe explorer.exe PID 4764 wrote to memory of 472 4764 explorer.exe explorer.exe PID 472 wrote to memory of 2120 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2120 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2120 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3408 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3408 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3408 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3572 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3572 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3572 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2560 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2560 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2560 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 848 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 848 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 848 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3796 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3796 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3796 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4372 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4372 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4372 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2712 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2712 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2712 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2292 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2292 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2292 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 1544 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 1544 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 1544 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4432 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4432 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4432 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4400 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4400 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4400 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4960 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4960 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4960 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3756 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3756 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 3756 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4108 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4108 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 4108 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2912 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2912 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2912 472 explorer.exe spoolsv.exe PID 472 wrote to memory of 2148 472 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a3e26d18d3300e4251f065a6d82bb45_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5ab82394c813d0addebbe3fbee8438d8b
SHA1b95eeaab3a905937e989a51fdcd89aa93ec748ed
SHA25656865397c162b6ea376a1f3bd8f17f9d79f459be19f502b4ec1e9c5f750dff0d
SHA512f6c6814da7aa5cac8cfd70c2f3f41d637df71ffa1fd61be7fa441f6a36bee03c526a538d41b901977e26b7c23c54f8b85ce9e1d9e2379c7be5970e5c2dfdf237
-
\??\c:\windows\system\explorer.exeFilesize
2.2MB
MD5776d8f2759bbf7e996a6ff1c9d626008
SHA17e3a4b582073cd0b25423f19dd6d8df6d41033ea
SHA256fc093adada911e74fbee23e07126a03725a54887cf1357405870edcd6528cb76
SHA512b7ce68957f42f32ce3a75f6ad4e9552765375f111ad56ac16c862af9acf001171946fc5cd8bd8f562c20a37ce14081819fb8b09394683fed240d23552f7dc098
-
memory/64-5754-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/224-3112-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/416-5790-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/472-72-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/472-977-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/520-3764-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/520-3667-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/688-2904-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/696-5438-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/848-1192-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1052-3170-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1052-3175-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1164-5614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1312-2262-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/1312-2263-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1492-2679-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1544-1567-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1564-22-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1564-18-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/1564-0-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/1564-16-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1820-3365-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1924-3375-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1928-2255-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2040-3163-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2040-3160-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2080-3093-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2080-3278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2120-978-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-2253-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2148-2020-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2232-3557-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2232-3644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2292-1566-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2352-3786-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2484-3335-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-3327-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-3450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2560-2435-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2560-1191-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2612-5760-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2688-2247-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2712-1375-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2776-4234-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2912-2019-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3100-2245-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3172-5580-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3184-3348-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3408-2264-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3408-979-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3572-2364-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3572-980-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3756-1780-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3796-1373-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3804-2362-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3988-5356-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4068-2892-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4104-4116-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4108-2018-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4224-4531-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4284-2414-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4284-2256-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4340-2244-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4356-5733-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4360-2246-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4372-1374-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4400-1778-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4432-1568-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4540-5779-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4544-19-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4544-21-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4544-57-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4592-5587-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4764-68-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4764-73-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4792-4709-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4832-5626-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4832-5622-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4960-1779-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5124-2798-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5124-3000-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5164-4994-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5248-3686-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5260-2600-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5260-2760-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5276-2365-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5404-3250-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5476-2874-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5504-3132-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5544-2882-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5576-3149-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5616-2575-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5616-2440-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5716-5448-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5748-2690-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5800-5285-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5820-2701-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5836-5293-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5840-2934-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5872-2721-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5908-5635-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5924-3567-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5956-5611-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6080-2529-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB