Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 13:44
Behavioral task
behavioral1
Sample
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
6b214ace0c1343ee65660c5e8c19e714
-
SHA1
629ad1be1699a2f83618aba735c0bd9543f2e7b2
-
SHA256
28a9eb8953fbe5d833c7855b6021b95fb620899896d097ddde7f6f94fffbd41b
-
SHA512
6d5a147b6c1bf56adc9cd19f8ba1099cfc358b86e82aa4ca7b50ef015a7b8f6787cc1809acda3c1f607c3cc4b6ab3fad35823024b04c4f3526f8428afb3346d9
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwww
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 1424 explorer.exe 4260 explorer.exe 3460 spoolsv.exe 1520 spoolsv.exe 868 spoolsv.exe 3572 spoolsv.exe 3904 spoolsv.exe 1304 spoolsv.exe 2372 spoolsv.exe 2404 spoolsv.exe 4364 spoolsv.exe 2756 spoolsv.exe 4400 spoolsv.exe 1636 spoolsv.exe 1816 spoolsv.exe 4868 spoolsv.exe 4388 spoolsv.exe 3672 spoolsv.exe 2008 spoolsv.exe 2424 spoolsv.exe 1920 spoolsv.exe 1172 spoolsv.exe 3632 spoolsv.exe 2016 spoolsv.exe 4456 spoolsv.exe 2180 spoolsv.exe 1180 spoolsv.exe 2360 spoolsv.exe 2896 spoolsv.exe 4696 spoolsv.exe 2988 spoolsv.exe 376 spoolsv.exe 3428 spoolsv.exe 4796 explorer.exe 4512 spoolsv.exe 3684 spoolsv.exe 4488 spoolsv.exe 3288 spoolsv.exe 2140 spoolsv.exe 3980 spoolsv.exe 1888 spoolsv.exe 804 explorer.exe 2660 spoolsv.exe 112 spoolsv.exe 3680 spoolsv.exe 380 spoolsv.exe 1464 spoolsv.exe 4040 spoolsv.exe 4832 explorer.exe 1244 spoolsv.exe 5060 spoolsv.exe 1704 spoolsv.exe 1852 spoolsv.exe 3720 spoolsv.exe 3228 spoolsv.exe 4320 spoolsv.exe 3704 explorer.exe 1320 spoolsv.exe 1676 spoolsv.exe 3772 spoolsv.exe 3468 spoolsv.exe 4396 spoolsv.exe 3552 explorer.exe 1908 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
Processes:
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1920 set thread context of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 1424 set thread context of 4260 1424 explorer.exe explorer.exe PID 3460 set thread context of 3428 3460 spoolsv.exe spoolsv.exe PID 1520 set thread context of 4512 1520 spoolsv.exe spoolsv.exe PID 868 set thread context of 3684 868 spoolsv.exe spoolsv.exe PID 3572 set thread context of 3288 3572 spoolsv.exe spoolsv.exe PID 3904 set thread context of 2140 3904 spoolsv.exe spoolsv.exe PID 1304 set thread context of 3980 1304 spoolsv.exe spoolsv.exe PID 2372 set thread context of 1888 2372 spoolsv.exe spoolsv.exe PID 2404 set thread context of 2660 2404 spoolsv.exe spoolsv.exe PID 4364 set thread context of 3680 4364 spoolsv.exe spoolsv.exe PID 2756 set thread context of 380 2756 spoolsv.exe spoolsv.exe PID 4400 set thread context of 1464 4400 spoolsv.exe spoolsv.exe PID 1636 set thread context of 4040 1636 spoolsv.exe spoolsv.exe PID 1816 set thread context of 5060 1816 spoolsv.exe spoolsv.exe PID 4868 set thread context of 1704 4868 spoolsv.exe spoolsv.exe PID 4388 set thread context of 1852 4388 spoolsv.exe spoolsv.exe PID 3672 set thread context of 3720 3672 spoolsv.exe spoolsv.exe PID 2008 set thread context of 4320 2008 spoolsv.exe spoolsv.exe PID 2424 set thread context of 1320 2424 spoolsv.exe spoolsv.exe PID 1920 set thread context of 1676 1920 spoolsv.exe spoolsv.exe PID 1172 set thread context of 3772 1172 spoolsv.exe spoolsv.exe PID 3632 set thread context of 4396 3632 spoolsv.exe spoolsv.exe PID 2016 set thread context of 1908 2016 spoolsv.exe spoolsv.exe PID 4456 set thread context of 212 4456 spoolsv.exe spoolsv.exe PID 2180 set thread context of 5008 2180 spoolsv.exe spoolsv.exe PID 1180 set thread context of 4748 1180 spoolsv.exe spoolsv.exe PID 2360 set thread context of 1124 2360 spoolsv.exe spoolsv.exe PID 2896 set thread context of 3304 2896 spoolsv.exe spoolsv.exe PID 4696 set thread context of 4568 4696 spoolsv.exe spoolsv.exe PID 2988 set thread context of 1412 2988 spoolsv.exe spoolsv.exe PID 376 set thread context of 792 376 spoolsv.exe spoolsv.exe PID 4796 set thread context of 900 4796 explorer.exe explorer.exe PID 4488 set thread context of 860 4488 spoolsv.exe spoolsv.exe PID 804 set thread context of 4344 804 explorer.exe explorer.exe PID 112 set thread context of 3196 112 spoolsv.exe spoolsv.exe PID 1244 set thread context of 4984 1244 spoolsv.exe spoolsv.exe PID 4832 set thread context of 3996 4832 explorer.exe explorer.exe PID 3704 set thread context of 3764 3704 explorer.exe explorer.exe PID 3228 set thread context of 2980 3228 spoolsv.exe spoolsv.exe PID 3468 set thread context of 756 3468 spoolsv.exe spoolsv.exe PID 3552 set thread context of 1864 3552 explorer.exe explorer.exe PID 3724 set thread context of 208 3724 spoolsv.exe spoolsv.exe PID 5044 set thread context of 3056 5044 explorer.exe explorer.exe PID 2020 set thread context of 4296 2020 spoolsv.exe spoolsv.exe PID 1900 set thread context of 824 1900 spoolsv.exe spoolsv.exe PID 3172 set thread context of 3232 3172 spoolsv.exe spoolsv.exe PID 904 set thread context of 2448 904 explorer.exe explorer.exe PID 3600 set thread context of 5072 3600 spoolsv.exe spoolsv.exe PID 3200 set thread context of 2268 3200 spoolsv.exe spoolsv.exe PID 3700 set thread context of 3404 3700 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exe6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exeexplorer.exepid process 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4260 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 3428 spoolsv.exe 3428 spoolsv.exe 4512 spoolsv.exe 4512 spoolsv.exe 3684 spoolsv.exe 3684 spoolsv.exe 3288 spoolsv.exe 3288 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 3980 spoolsv.exe 3980 spoolsv.exe 1888 spoolsv.exe 1888 spoolsv.exe 2660 spoolsv.exe 2660 spoolsv.exe 3680 spoolsv.exe 3680 spoolsv.exe 380 spoolsv.exe 380 spoolsv.exe 1464 spoolsv.exe 1464 spoolsv.exe 4040 spoolsv.exe 4040 spoolsv.exe 5060 spoolsv.exe 5060 spoolsv.exe 1704 spoolsv.exe 1704 spoolsv.exe 1852 spoolsv.exe 1852 spoolsv.exe 3720 spoolsv.exe 3720 spoolsv.exe 4320 spoolsv.exe 4320 spoolsv.exe 1320 spoolsv.exe 1320 spoolsv.exe 1676 spoolsv.exe 1676 spoolsv.exe 3772 spoolsv.exe 3772 spoolsv.exe 4396 spoolsv.exe 4396 spoolsv.exe 1908 spoolsv.exe 1908 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 5008 spoolsv.exe 5008 spoolsv.exe 1124 spoolsv.exe 1124 spoolsv.exe 3304 spoolsv.exe 3304 spoolsv.exe 4568 spoolsv.exe 4568 spoolsv.exe 1412 spoolsv.exe 1412 spoolsv.exe 792 spoolsv.exe 792 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1920 wrote to memory of 1092 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe splwow64.exe PID 1920 wrote to memory of 1092 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe splwow64.exe PID 1920 wrote to memory of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 1920 wrote to memory of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 1920 wrote to memory of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 1920 wrote to memory of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 1920 wrote to memory of 2296 1920 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe PID 2296 wrote to memory of 1424 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe explorer.exe PID 2296 wrote to memory of 1424 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe explorer.exe PID 2296 wrote to memory of 1424 2296 6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe explorer.exe PID 1424 wrote to memory of 4260 1424 explorer.exe explorer.exe PID 1424 wrote to memory of 4260 1424 explorer.exe explorer.exe PID 1424 wrote to memory of 4260 1424 explorer.exe explorer.exe PID 1424 wrote to memory of 4260 1424 explorer.exe explorer.exe PID 1424 wrote to memory of 4260 1424 explorer.exe explorer.exe PID 4260 wrote to memory of 3460 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3460 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3460 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1520 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1520 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1520 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3572 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3572 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3572 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3904 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3904 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3904 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1304 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1304 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1304 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2372 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2372 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2372 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2404 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2404 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2404 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4364 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4364 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4364 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2756 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2756 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2756 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4400 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4400 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4400 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1636 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1636 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1636 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1816 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1816 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 1816 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4868 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4388 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4388 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 4388 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3672 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3672 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 3672 4260 explorer.exe spoolsv.exe PID 4260 wrote to memory of 2008 4260 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b214ace0c1343ee65660c5e8c19e714_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD565748b2f8c3c119efdedd9ae5b5a729a
SHA17e09bdae68cc16458f7389f803642d6a038f9999
SHA2561b07c42e7f198afe075ede2acb55f335cb3ac565b25947ee7e23cd3c1c977459
SHA512b037052b127048191ec8a26e46ac268c1bbdf46c91d23e517ba623e776bf0efb22861be8d4e1ea8ec89275ce3caf12090f0e6a0ea1622e079a6c8820dfe4fefa
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5fb1d41bb812ac4597bf94b6bd24ffcb8
SHA192f30d9b3952ab7e73b5b39078f5eae3376cdf16
SHA256614f24480504940e0b3aa5ba493794babd5484af21df51f9da9aac1dc4878b60
SHA51210143bf729a53db303cf8ad19797c5fcbbd1a3763cacbb747123eaa40776ee7fa5b9d51be99a8989bb1d925bf441ab0512ad1e7042e747c6a10418c837c2d81e
-
memory/208-5030-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/208-4827-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/212-2847-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/380-2332-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/756-4601-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/792-3354-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/792-3256-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/824-4856-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/860-3606-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/868-2078-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/868-1062-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/900-3462-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1124-2935-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1124-2938-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1172-2035-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1304-1225-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1320-2660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1412-3022-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1424-90-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1424-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1520-1061-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1520-2043-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1636-1613-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1676-2675-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1676-2671-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1704-2522-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1816-1792-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1852-2534-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1864-4611-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1888-2399-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1888-2227-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1908-2839-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1920-2034-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1920-37-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1920-33-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/1920-31-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1920-0-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/2008-1954-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2016-2081-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2140-2161-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2268-4971-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2296-36-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2296-67-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2296-79-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2296-34-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2372-1226-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2404-1422-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2424-1955-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2448-4954-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2660-2241-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2660-2236-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2756-1424-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2980-4322-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3048-5122-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3056-4837-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3196-3808-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3196-3895-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3232-4941-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3268-5131-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3288-2147-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3304-3121-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3404-4982-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3428-2036-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3428-2205-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3460-2030-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3460-915-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3484-5113-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3572-1063-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3632-2045-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3672-1953-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3680-2319-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3684-2082-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3720-2541-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3764-4315-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3772-2682-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3904-1224-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3980-2168-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3980-2173-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3996-4132-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4040-2416-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4040-2630-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-89-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-914-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-4848-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-4843-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-2746-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-2652-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4344-3800-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4364-1423-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4388-1799-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4396-2831-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4396-2986-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4400-1612-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4512-2046-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4568-3011-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4748-2866-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4868-1793-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4984-4220-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4984-4124-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5008-2857-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5008-2860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-2510-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB