Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 17:21
Behavioral task
behavioral1
Sample
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
6f43490d501da4ae9e35a2e67ffe3049
-
SHA1
a229f4338856bad7af48d286300bedb7d62747ae
-
SHA256
51cff0f4d239a5744ec11d9497ce87b387e96cd0fc089d040c2ea71bb5a31009
-
SHA512
1bca948de55b5523e0fd69c507e71f2a90419ec09390cfa5d227254caf3d11112e454e53cb7eaf867654b90fe909e01ea24577505574b97e0a13a69c81a119e6
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWww9
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 2836 explorer.exe 2768 explorer.exe 2300 spoolsv.exe 1680 spoolsv.exe 660 spoolsv.exe 2196 spoolsv.exe 948 spoolsv.exe 1164 spoolsv.exe 2380 spoolsv.exe 2620 spoolsv.exe 1656 spoolsv.exe 2468 spoolsv.exe 1528 spoolsv.exe 2908 spoolsv.exe 1592 spoolsv.exe 2452 spoolsv.exe 1468 spoolsv.exe 1552 spoolsv.exe 1556 spoolsv.exe 276 spoolsv.exe 1072 spoolsv.exe 2820 spoolsv.exe 860 spoolsv.exe 1168 spoolsv.exe 2712 spoolsv.exe 848 spoolsv.exe 1672 spoolsv.exe 1916 spoolsv.exe 2604 spoolsv.exe 1484 spoolsv.exe 2788 spoolsv.exe 1360 spoolsv.exe 2268 spoolsv.exe 1496 spoolsv.exe 2888 spoolsv.exe 1196 spoolsv.exe 1500 spoolsv.exe 2976 spoolsv.exe 2824 spoolsv.exe 2656 spoolsv.exe 2608 spoolsv.exe 2744 spoolsv.exe 2336 spoolsv.exe 2728 spoolsv.exe 1796 spoolsv.exe 792 spoolsv.exe 740 spoolsv.exe 2372 spoolsv.exe 1848 spoolsv.exe 928 spoolsv.exe 2616 spoolsv.exe 2556 spoolsv.exe 1396 spoolsv.exe 3056 spoolsv.exe 3060 explorer.exe 2952 spoolsv.exe 2440 spoolsv.exe 2972 spoolsv.exe 1684 spoolsv.exe 2960 spoolsv.exe 972 spoolsv.exe 2584 explorer.exe 1372 spoolsv.exe 2508 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exepid process 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2660 set thread context of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2836 set thread context of 2768 2836 explorer.exe explorer.exe PID 1680 set thread context of 3056 1680 spoolsv.exe spoolsv.exe PID 2300 set thread context of 2952 2300 spoolsv.exe spoolsv.exe PID 2196 set thread context of 2440 2196 spoolsv.exe spoolsv.exe PID 660 set thread context of 1684 660 spoolsv.exe spoolsv.exe PID 1164 set thread context of 2960 1164 spoolsv.exe spoolsv.exe PID 948 set thread context of 972 948 spoolsv.exe spoolsv.exe PID 2620 set thread context of 2508 2620 spoolsv.exe spoolsv.exe PID 2380 set thread context of 3168 2380 spoolsv.exe spoolsv.exe PID 2468 set thread context of 3288 2468 spoolsv.exe spoolsv.exe PID 2908 set thread context of 3460 2908 spoolsv.exe spoolsv.exe PID 1656 set thread context of 3532 1656 spoolsv.exe spoolsv.exe PID 2452 set thread context of 3544 2452 spoolsv.exe spoolsv.exe PID 1528 set thread context of 3640 1528 spoolsv.exe spoolsv.exe PID 1552 set thread context of 3656 1552 spoolsv.exe spoolsv.exe PID 2556 set thread context of 3784 2556 spoolsv.exe spoolsv.exe PID 276 set thread context of 3776 276 spoolsv.exe spoolsv.exe PID 1592 set thread context of 3872 1592 spoolsv.exe spoolsv.exe PID 1468 set thread context of 3920 1468 spoolsv.exe spoolsv.exe PID 2820 set thread context of 3996 2820 spoolsv.exe spoolsv.exe PID 1556 set thread context of 4032 1556 spoolsv.exe spoolsv.exe PID 1168 set thread context of 4068 1168 spoolsv.exe spoolsv.exe PID 1072 set thread context of 2308 1072 spoolsv.exe spoolsv.exe PID 1916 set thread context of 2524 1916 spoolsv.exe spoolsv.exe PID 848 set thread context of 2348 848 spoolsv.exe spoolsv.exe PID 1484 set thread context of 3248 1484 spoolsv.exe spoolsv.exe PID 1360 set thread context of 2260 1360 spoolsv.exe spoolsv.exe PID 1496 set thread context of 3220 1496 spoolsv.exe spoolsv.exe PID 860 set thread context of 1212 860 spoolsv.exe spoolsv.exe PID 2744 set thread context of 3368 2744 spoolsv.exe spoolsv.exe PID 2712 set thread context of 3448 2712 spoolsv.exe spoolsv.exe PID 1196 set thread context of 944 1196 spoolsv.exe spoolsv.exe PID 1672 set thread context of 3428 1672 spoolsv.exe spoolsv.exe PID 792 set thread context of 3404 792 spoolsv.exe spoolsv.exe PID 928 set thread context of 3580 928 spoolsv.exe spoolsv.exe PID 2656 set thread context of 3440 2656 spoolsv.exe spoolsv.exe PID 2372 set thread context of 2384 2372 spoolsv.exe spoolsv.exe PID 2728 set thread context of 3556 2728 spoolsv.exe spoolsv.exe PID 2604 set thread context of 3676 2604 spoolsv.exe spoolsv.exe PID 2788 set thread context of 320 2788 spoolsv.exe spoolsv.exe PID 740 set thread context of 3724 740 spoolsv.exe spoolsv.exe PID 1500 set thread context of 3832 1500 spoolsv.exe spoolsv.exe PID 2976 set thread context of 2012 2976 spoolsv.exe spoolsv.exe PID 2616 set thread context of 3960 2616 spoolsv.exe spoolsv.exe PID 1796 set thread context of 3972 1796 spoolsv.exe spoolsv.exe PID 2888 set thread context of 1052 2888 spoolsv.exe spoolsv.exe PID 2336 set thread context of 3988 2336 spoolsv.exe spoolsv.exe PID 2824 set thread context of 1304 2824 spoolsv.exe spoolsv.exe PID 2268 set thread context of 4016 2268 spoolsv.exe spoolsv.exe PID 2608 set thread context of 1816 2608 spoolsv.exe spoolsv.exe PID 1848 set thread context of 1696 1848 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exepid process 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2768 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 2768 explorer.exe 3056 spoolsv.exe 3056 spoolsv.exe 2952 spoolsv.exe 2952 spoolsv.exe 2440 spoolsv.exe 2440 spoolsv.exe 1684 spoolsv.exe 1684 spoolsv.exe 2960 spoolsv.exe 2960 spoolsv.exe 972 spoolsv.exe 972 spoolsv.exe 2508 spoolsv.exe 2508 spoolsv.exe 3168 spoolsv.exe 3168 spoolsv.exe 3288 spoolsv.exe 3288 spoolsv.exe 3460 spoolsv.exe 3460 spoolsv.exe 3532 spoolsv.exe 3532 spoolsv.exe 3544 spoolsv.exe 3544 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 3656 spoolsv.exe 3656 spoolsv.exe 3776 spoolsv.exe 3784 spoolsv.exe 3776 spoolsv.exe 3784 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 3920 spoolsv.exe 3920 spoolsv.exe 3996 spoolsv.exe 4068 spoolsv.exe 4032 spoolsv.exe 3996 spoolsv.exe 4068 spoolsv.exe 4032 spoolsv.exe 2308 spoolsv.exe 2308 spoolsv.exe 2524 spoolsv.exe 2524 spoolsv.exe 2348 spoolsv.exe 2348 spoolsv.exe 2260 spoolsv.exe 2260 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 3248 spoolsv.exe 3248 spoolsv.exe 3428 spoolsv.exe 3428 spoolsv.exe 1212 spoolsv.exe 1212 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2660 wrote to memory of 2904 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe splwow64.exe PID 2660 wrote to memory of 2904 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe splwow64.exe PID 2660 wrote to memory of 2904 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe splwow64.exe PID 2660 wrote to memory of 2904 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe splwow64.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2660 wrote to memory of 2488 2660 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe PID 2488 wrote to memory of 2836 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe explorer.exe PID 2488 wrote to memory of 2836 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe explorer.exe PID 2488 wrote to memory of 2836 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe explorer.exe PID 2488 wrote to memory of 2836 2488 6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2836 wrote to memory of 2768 2836 explorer.exe explorer.exe PID 2768 wrote to memory of 2300 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2300 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2300 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2300 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1680 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1680 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1680 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1680 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 660 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 660 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 660 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 660 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2196 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2196 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2196 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2196 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 948 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 948 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 948 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 948 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1164 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1164 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1164 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1164 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2380 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2380 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2380 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2380 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2620 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2620 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2620 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2620 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1656 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1656 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1656 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1656 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2468 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2468 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2468 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 2468 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1528 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1528 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1528 2768 explorer.exe spoolsv.exe PID 2768 wrote to memory of 1528 2768 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
C:\Windows\system\explorer.exeFilesize
2.2MB
MD5b8a5c6dda1f001d166bbe24b770d2944
SHA1f3259d1c3f3d29beacd78485a60971758897341c
SHA25629a88e41b471a0834ae0eb517a632f77d87667d904e18100f0395701cd3ef321
SHA5122fa2adc0154992ec56525c0ec964aebdb2b61a39df6ba25a304380eac731cf6f2670525e4e668bd04c7f6eec68b8cb465f3b955bf5378ba8f71b180a7719dac2
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD52026586ecfc34b6daa171fd5f2cdfeec
SHA15d0765c4d25b638af5966a45f2ce559632d530eb
SHA256fb53c625b1966843125480d7e8f8cfd96d004009e5748674ec1b1b7e7f9ec309
SHA512edf7ebe1eea1033f90554399c950127bce737d76894354316ce4f4087e3517301ded72b0afab1517b01d58c4f6d8691c3b69f65c878f4ca7b9cd2d5f51692525
-
memory/276-1645-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/320-2675-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/660-892-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/848-1854-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/860-1851-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/944-2677-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/948-1080-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/972-2580-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/972-2248-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1052-2789-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1072-1646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1164-1081-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1168-1852-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1360-2101-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1468-1460-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1484-2099-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1528-1456-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1552-1466-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1556-1644-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1592-1458-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1656-1278-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1672-1855-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1680-891-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1684-2200-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-2796-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1916-2097-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2012-2812-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2196-1079-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2260-2670-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2300-890-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2308-2657-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2380-1276-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2384-2672-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2440-2160-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2452-1459-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2468-1279-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2488-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2488-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2488-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2488-54-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2488-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2508-2269-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2604-2098-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2620-1277-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2660-0-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2660-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2660-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2660-19-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2712-1853-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2768-889-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2788-2100-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2820-1647-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2836-60-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2836-42-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2836-70-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2908-1457-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2952-2136-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2960-2201-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3056-2118-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3056-2202-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3168-2281-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3288-2316-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3368-2676-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3440-2673-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3460-2337-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3532-2350-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3556-2674-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3640-2372-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3676-2671-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3776-2403-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3832-2747-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3920-2429-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4068-2656-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB