Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 00:46
Behavioral task
behavioral1
Sample
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
70540fdbecf023039bc426d67f7b062c
-
SHA1
7c284ef87b797f240a1832a4c1d93345b6970ddd
-
SHA256
a5afd662dcb8d7b0d427d98741ff32405c998ab9a763bec44f7eca61cd9441c5
-
SHA512
560b097fdcabb8763013f0bc473a3c6f759fcd2585f80418fffe7941d61d738b0c84873a794bf97bf644f199f7a91633c3155113b6b9f291ebd5a14ec05a976e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwh
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1340 explorer.exe 2548 explorer.exe 4440 spoolsv.exe 2472 spoolsv.exe 1056 spoolsv.exe 2056 spoolsv.exe 4204 spoolsv.exe 1288 spoolsv.exe 1344 spoolsv.exe 3192 spoolsv.exe 2992 spoolsv.exe 4976 spoolsv.exe 2160 spoolsv.exe 3496 spoolsv.exe 5092 spoolsv.exe 3008 spoolsv.exe 1836 spoolsv.exe 2388 spoolsv.exe 4928 spoolsv.exe 5116 spoolsv.exe 1516 spoolsv.exe 5060 spoolsv.exe 2600 spoolsv.exe 4960 spoolsv.exe 3604 spoolsv.exe 3444 spoolsv.exe 5004 spoolsv.exe 3276 spoolsv.exe 4720 spoolsv.exe 3296 spoolsv.exe 3116 spoolsv.exe 3180 spoolsv.exe 2652 spoolsv.exe 944 spoolsv.exe 1852 spoolsv.exe 3208 spoolsv.exe 2352 spoolsv.exe 640 spoolsv.exe 3320 explorer.exe 1460 spoolsv.exe 4972 spoolsv.exe 4860 spoolsv.exe 3016 spoolsv.exe 4176 spoolsv.exe 4692 spoolsv.exe 1460 spoolsv.exe 4028 spoolsv.exe 4496 explorer.exe 8 spoolsv.exe 5068 spoolsv.exe 4064 spoolsv.exe 2360 spoolsv.exe 1340 spoolsv.exe 452 spoolsv.exe 2312 spoolsv.exe 5048 spoolsv.exe 4460 spoolsv.exe 3980 spoolsv.exe 4468 explorer.exe 4080 spoolsv.exe 3752 spoolsv.exe 1148 spoolsv.exe 432 spoolsv.exe 4812 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 63 IoCs
Processes:
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 3148 set thread context of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 1340 set thread context of 2548 1340 explorer.exe explorer.exe PID 4440 set thread context of 640 4440 spoolsv.exe spoolsv.exe PID 2472 set thread context of 1460 2472 spoolsv.exe spoolsv.exe PID 1056 set thread context of 4972 1056 spoolsv.exe spoolsv.exe PID 2056 set thread context of 4860 2056 spoolsv.exe spoolsv.exe PID 4204 set thread context of 3016 4204 spoolsv.exe spoolsv.exe PID 1288 set thread context of 4176 1288 spoolsv.exe spoolsv.exe PID 1344 set thread context of 1460 1344 spoolsv.exe spoolsv.exe PID 3192 set thread context of 4028 3192 spoolsv.exe spoolsv.exe PID 2992 set thread context of 8 2992 spoolsv.exe spoolsv.exe PID 4976 set thread context of 5068 4976 spoolsv.exe spoolsv.exe PID 2160 set thread context of 4064 2160 spoolsv.exe spoolsv.exe PID 3496 set thread context of 1340 3496 spoolsv.exe spoolsv.exe PID 5092 set thread context of 452 5092 spoolsv.exe spoolsv.exe PID 3008 set thread context of 2312 3008 spoolsv.exe spoolsv.exe PID 1836 set thread context of 5048 1836 spoolsv.exe spoolsv.exe PID 2388 set thread context of 4460 2388 spoolsv.exe spoolsv.exe PID 4928 set thread context of 3980 4928 spoolsv.exe spoolsv.exe PID 5116 set thread context of 4080 5116 spoolsv.exe spoolsv.exe PID 1516 set thread context of 1148 1516 spoolsv.exe spoolsv.exe PID 5060 set thread context of 432 5060 spoolsv.exe spoolsv.exe PID 2600 set thread context of 4812 2600 spoolsv.exe spoolsv.exe PID 4960 set thread context of 5024 4960 spoolsv.exe spoolsv.exe PID 3604 set thread context of 220 3604 spoolsv.exe spoolsv.exe PID 3444 set thread context of 3352 3444 spoolsv.exe spoolsv.exe PID 5004 set thread context of 3484 5004 spoolsv.exe spoolsv.exe PID 3276 set thread context of 3272 3276 spoolsv.exe spoolsv.exe PID 4720 set thread context of 1152 4720 spoolsv.exe spoolsv.exe PID 3296 set thread context of 920 3296 spoolsv.exe spoolsv.exe PID 3116 set thread context of 1268 3116 spoolsv.exe spoolsv.exe PID 3180 set thread context of 4560 3180 spoolsv.exe spoolsv.exe PID 2652 set thread context of 1564 2652 spoolsv.exe spoolsv.exe PID 944 set thread context of 4004 944 spoolsv.exe spoolsv.exe PID 1852 set thread context of 2648 1852 spoolsv.exe spoolsv.exe PID 3208 set thread context of 4388 3208 spoolsv.exe spoolsv.exe PID 2352 set thread context of 4760 2352 spoolsv.exe spoolsv.exe PID 3320 set thread context of 3504 3320 explorer.exe explorer.exe PID 4692 set thread context of 3384 4692 spoolsv.exe spoolsv.exe PID 4496 set thread context of 1860 4496 explorer.exe explorer.exe PID 2360 set thread context of 1528 2360 spoolsv.exe spoolsv.exe PID 4468 set thread context of 5560 4468 explorer.exe explorer.exe PID 3752 set thread context of 3732 3752 spoolsv.exe spoolsv.exe PID 2264 set thread context of 5264 2264 explorer.exe explorer.exe PID 3696 set thread context of 5656 3696 spoolsv.exe spoolsv.exe PID 2948 set thread context of 5844 2948 explorer.exe explorer.exe PID 3156 set thread context of 6024 3156 spoolsv.exe spoolsv.exe PID 5016 set thread context of 1320 5016 spoolsv.exe spoolsv.exe PID 1064 set thread context of 720 1064 explorer.exe explorer.exe PID 1376 set thread context of 5256 1376 spoolsv.exe spoolsv.exe PID 3672 set thread context of 5296 3672 spoolsv.exe spoolsv.exe PID 3740 set thread context of 5440 3740 spoolsv.exe spoolsv.exe PID 2328 set thread context of 5368 2328 spoolsv.exe spoolsv.exe PID 2128 set thread context of 5508 2128 spoolsv.exe spoolsv.exe PID 3372 set thread context of 5576 3372 spoolsv.exe spoolsv.exe PID 1176 set thread context of 5088 1176 spoolsv.exe spoolsv.exe PID 4836 set thread context of 932 4836 explorer.exe explorer.exe PID 3456 set thread context of 2136 3456 spoolsv.exe spoolsv.exe PID 3660 set thread context of 5764 3660 spoolsv.exe spoolsv.exe PID 3304 set thread context of 5796 3304 spoolsv.exe spoolsv.exe PID 4356 set thread context of 5916 4356 spoolsv.exe spoolsv.exe PID 3772 set thread context of 6060 3772 explorer.exe explorer.exe PID 4008 set thread context of 4804 4008 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exe70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exeexplorer.exepid process 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2548 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 2548 explorer.exe 640 spoolsv.exe 640 spoolsv.exe 1460 spoolsv.exe 1460 spoolsv.exe 4972 spoolsv.exe 4972 spoolsv.exe 4860 spoolsv.exe 4860 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 4176 spoolsv.exe 4176 spoolsv.exe 1460 spoolsv.exe 1460 spoolsv.exe 4028 spoolsv.exe 4028 spoolsv.exe 8 spoolsv.exe 8 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 4064 spoolsv.exe 4064 spoolsv.exe 1340 spoolsv.exe 1340 spoolsv.exe 452 spoolsv.exe 452 spoolsv.exe 2312 spoolsv.exe 2312 spoolsv.exe 5048 spoolsv.exe 5048 spoolsv.exe 4460 spoolsv.exe 4460 spoolsv.exe 3980 spoolsv.exe 3980 spoolsv.exe 4080 spoolsv.exe 4080 spoolsv.exe 1148 spoolsv.exe 1148 spoolsv.exe 432 spoolsv.exe 432 spoolsv.exe 4812 spoolsv.exe 4812 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 220 spoolsv.exe 220 spoolsv.exe 3352 spoolsv.exe 3352 spoolsv.exe 3484 spoolsv.exe 3484 spoolsv.exe 3272 spoolsv.exe 3272 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 920 spoolsv.exe 920 spoolsv.exe 1268 spoolsv.exe 1268 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3148 wrote to memory of 4660 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe splwow64.exe PID 3148 wrote to memory of 4660 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe splwow64.exe PID 3148 wrote to memory of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 3148 wrote to memory of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 3148 wrote to memory of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 3148 wrote to memory of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 3148 wrote to memory of 4944 3148 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe PID 4944 wrote to memory of 1340 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe explorer.exe PID 4944 wrote to memory of 1340 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe explorer.exe PID 4944 wrote to memory of 1340 4944 70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe explorer.exe PID 1340 wrote to memory of 2548 1340 explorer.exe explorer.exe PID 1340 wrote to memory of 2548 1340 explorer.exe explorer.exe PID 1340 wrote to memory of 2548 1340 explorer.exe explorer.exe PID 1340 wrote to memory of 2548 1340 explorer.exe explorer.exe PID 1340 wrote to memory of 2548 1340 explorer.exe explorer.exe PID 2548 wrote to memory of 4440 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4440 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4440 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2472 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2472 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2472 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2056 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4204 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4204 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4204 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1288 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1288 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1288 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1344 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1344 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1344 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3192 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3192 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3192 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2992 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2992 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2992 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4976 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4976 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4976 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2160 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2160 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2160 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3496 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3496 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3496 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 5092 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 5092 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 5092 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3008 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3008 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 3008 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1836 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1836 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 1836 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2388 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2388 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 2388 2548 explorer.exe spoolsv.exe PID 2548 wrote to memory of 4928 2548 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70540fdbecf023039bc426d67f7b062c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3320 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3504
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4176 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4028 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4496 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1860
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3980 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5560
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4812 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2264 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5264
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3484 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3272 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1268 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2948 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4560
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1564
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4388
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1064 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4760
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4836 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3384
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3772 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:6060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1528
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2848 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3732
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5656
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5684 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3156 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6024
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:5016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5508
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5796
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4804
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1444
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5972
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1752 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4896
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5101776af7ca6ca22dc3d7891a35f0b26
SHA18759fb097c4d0722307e3e72fbc20dd6dab5f449
SHA2565e8929c0bb3d0dfd4d310037fe080cdb0b1b51f162543276e7661f5c61259e94
SHA5121b54f003c214773102622bf682dc5236581cfedbd8588ac9dcd15745dc816c33abf2d59983c4e23b8868ecdec776069efa2efac4eb63f2946533a7c6ea230e6d
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD526c7b1add32f59eed0805188a7f34dce
SHA1d341937415ca82bc4a2031637364df489c3bf48e
SHA256d305892895c9df01623b2912739ef025a399a387bb92638110a9a06eb06436ae
SHA512cb254e48186a81dde86f1318e18dacc2c9a22e32e5f87b440efc812afe437d753a64e4521f7986bce4340f84b2a22267d57d3ed66f2b5407b7029e4d0fa6dcaf
-
memory/8-2526-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/220-2936-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/432-2833-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/432-2837-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/640-2498-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/640-2301-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/720-5618-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/932-5697-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1056-2318-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1056-1213-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1152-3037-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1268-3135-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1268-3288-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1288-1401-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1340-101-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1340-2637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1340-95-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1344-1402-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1460-2309-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1460-2444-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1516-2233-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1528-4600-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1528-4758-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1564-3242-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1836-2005-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1860-4515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2056-1214-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2136-5708-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2136-5704-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2160-1581-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2388-2011-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2472-2311-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2472-1212-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2548-100-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-1009-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2600-2235-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2648-3259-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2992-1579-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3008-1786-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3016-2345-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3148-36-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3148-38-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/3148-0-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/3148-42-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3192-1403-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3272-3026-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3384-4348-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3384-4250-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3444-2312-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3484-3017-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3496-1784-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3504-3925-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3604-2300-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3732-4929-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3732-5032-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3980-2731-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4004-3251-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4028-2703-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4028-2515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4064-2547-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4080-2739-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4176-2354-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4196-5914-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4204-1215-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4388-3474-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4388-3356-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4440-2296-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4440-1011-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4460-2674-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4560-3234-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4560-3229-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4760-3915-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4760-4028-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4804-5755-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4812-2919-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4812-3120-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4860-2333-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4928-2012-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4944-82-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4944-84-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4944-41-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4944-39-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4960-2299-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4972-2322-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4976-1580-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5004-2321-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5024-2928-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5048-2665-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-2234-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5068-2536-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5088-5686-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5092-1785-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5116-2013-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5256-5628-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5256-5624-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5264-5202-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5296-5637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5508-5660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5560-4776-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5576-5670-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5576-5673-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5656-5285-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5656-5415-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5796-5722-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5844-5588-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5916-5733-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5972-6046-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6024-5596-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6024-5748-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6060-5747-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB