Analysis
-
max time kernel
130s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 14:58
Behavioral task
behavioral1
Sample
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
75db9471f0b48fe06523042169d5efdc
-
SHA1
9d42bb40be8691040f42943f6bafb1801e6029eb
-
SHA256
20477e125ec443496bfb01a2996d48cce1248ee971b1238a4fab2eaea50d311f
-
SHA512
6a77aa98b774c1001a53f00895ab82eb682b08b08f7005cb39911d73ebbcb9193bf112cc96b3bf315090c38776332951bf83a7f9104c246af51bb37572614cf1
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwx
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 2164 explorer.exe 2504 explorer.exe 3240 spoolsv.exe 2280 spoolsv.exe 5060 spoolsv.exe 1916 spoolsv.exe 4556 spoolsv.exe 1708 spoolsv.exe 224 spoolsv.exe 948 spoolsv.exe 2692 spoolsv.exe 3504 spoolsv.exe 4704 spoolsv.exe 1696 spoolsv.exe 3032 spoolsv.exe 4320 spoolsv.exe 2728 spoolsv.exe 3896 spoolsv.exe 3016 spoolsv.exe 976 spoolsv.exe 4624 spoolsv.exe 2256 spoolsv.exe 1796 spoolsv.exe 2816 spoolsv.exe 3332 spoolsv.exe 3628 spoolsv.exe 2340 spoolsv.exe 1412 spoolsv.exe 5056 spoolsv.exe 2132 spoolsv.exe 3120 spoolsv.exe 2960 spoolsv.exe 2312 explorer.exe 928 spoolsv.exe 1332 spoolsv.exe 2764 spoolsv.exe 2052 explorer.exe 4440 spoolsv.exe 2812 spoolsv.exe 3904 spoolsv.exe 4960 spoolsv.exe 4336 spoolsv.exe 4708 spoolsv.exe 848 explorer.exe 1724 spoolsv.exe 4160 spoolsv.exe 5008 spoolsv.exe 2768 spoolsv.exe 3932 spoolsv.exe 3612 explorer.exe 5024 spoolsv.exe 4760 spoolsv.exe 2884 spoolsv.exe 3108 spoolsv.exe 4828 spoolsv.exe 652 explorer.exe 3908 spoolsv.exe 2124 spoolsv.exe 1768 spoolsv.exe 4640 spoolsv.exe 2700 spoolsv.exe 3924 explorer.exe 1588 spoolsv.exe 5028 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 39 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1804 set thread context of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 2164 set thread context of 2504 2164 explorer.exe explorer.exe PID 3240 set thread context of 2960 3240 spoolsv.exe spoolsv.exe PID 2280 set thread context of 928 2280 spoolsv.exe spoolsv.exe PID 5060 set thread context of 1332 5060 spoolsv.exe spoolsv.exe PID 1916 set thread context of 2764 1916 spoolsv.exe spoolsv.exe PID 4556 set thread context of 2812 4556 spoolsv.exe spoolsv.exe PID 1708 set thread context of 3904 1708 spoolsv.exe spoolsv.exe PID 224 set thread context of 4960 224 spoolsv.exe spoolsv.exe PID 948 set thread context of 4708 948 spoolsv.exe spoolsv.exe PID 2692 set thread context of 1724 2692 spoolsv.exe spoolsv.exe PID 3504 set thread context of 4160 3504 spoolsv.exe spoolsv.exe PID 4704 set thread context of 2768 4704 spoolsv.exe spoolsv.exe PID 1696 set thread context of 3932 1696 spoolsv.exe spoolsv.exe PID 3032 set thread context of 5024 3032 spoolsv.exe spoolsv.exe PID 4320 set thread context of 4760 4320 spoolsv.exe spoolsv.exe PID 2728 set thread context of 3108 2728 spoolsv.exe spoolsv.exe PID 3896 set thread context of 4828 3896 spoolsv.exe spoolsv.exe PID 3016 set thread context of 3908 3016 spoolsv.exe spoolsv.exe PID 976 set thread context of 2124 976 spoolsv.exe spoolsv.exe PID 4624 set thread context of 1768 4624 spoolsv.exe spoolsv.exe PID 2256 set thread context of 2700 2256 spoolsv.exe spoolsv.exe PID 1796 set thread context of 1588 1796 spoolsv.exe spoolsv.exe PID 2816 set thread context of 5028 2816 spoolsv.exe spoolsv.exe PID 3332 set thread context of 4700 3332 spoolsv.exe spoolsv.exe PID 3628 set thread context of 1652 3628 spoolsv.exe spoolsv.exe PID 2340 set thread context of 4592 2340 spoolsv.exe spoolsv.exe PID 1412 set thread context of 3340 1412 spoolsv.exe spoolsv.exe PID 5056 set thread context of 1560 5056 spoolsv.exe spoolsv.exe PID 2132 set thread context of 1176 2132 spoolsv.exe spoolsv.exe PID 2312 set thread context of 1092 2312 explorer.exe explorer.exe PID 3120 set thread context of 2856 3120 spoolsv.exe spoolsv.exe PID 2052 set thread context of 2988 2052 explorer.exe explorer.exe PID 4440 set thread context of 2976 4440 spoolsv.exe spoolsv.exe PID 4336 set thread context of 2544 4336 spoolsv.exe spoolsv.exe PID 848 set thread context of 3464 848 explorer.exe explorer.exe PID 5008 set thread context of 3964 5008 spoolsv.exe spoolsv.exe PID 3612 set thread context of 528 3612 explorer.exe explorer.exe PID 2884 set thread context of 3388 2884 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exeexplorer.exepid process 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2504 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2504 explorer.exe 2960 spoolsv.exe 2960 spoolsv.exe 928 spoolsv.exe 928 spoolsv.exe 1332 spoolsv.exe 1332 spoolsv.exe 2764 spoolsv.exe 2764 spoolsv.exe 2812 spoolsv.exe 2812 spoolsv.exe 3904 spoolsv.exe 3904 spoolsv.exe 4960 spoolsv.exe 4960 spoolsv.exe 4708 spoolsv.exe 4708 spoolsv.exe 1724 spoolsv.exe 1724 spoolsv.exe 4160 spoolsv.exe 4160 spoolsv.exe 2768 spoolsv.exe 2768 spoolsv.exe 3932 spoolsv.exe 3932 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 4760 spoolsv.exe 4760 spoolsv.exe 3108 spoolsv.exe 3108 spoolsv.exe 4828 spoolsv.exe 4828 spoolsv.exe 3908 spoolsv.exe 3908 spoolsv.exe 2124 spoolsv.exe 2124 spoolsv.exe 1768 spoolsv.exe 1768 spoolsv.exe 2700 spoolsv.exe 2700 spoolsv.exe 1588 spoolsv.exe 1588 spoolsv.exe 5028 spoolsv.exe 5028 spoolsv.exe 4700 spoolsv.exe 4700 spoolsv.exe 1652 spoolsv.exe 1652 spoolsv.exe 4592 spoolsv.exe 4592 spoolsv.exe 3340 spoolsv.exe 3340 spoolsv.exe 1560 spoolsv.exe 1560 spoolsv.exe 1176 spoolsv.exe 1176 spoolsv.exe 1092 explorer.exe 1092 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1804 wrote to memory of 212 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe splwow64.exe PID 1804 wrote to memory of 212 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe splwow64.exe PID 1804 wrote to memory of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 1804 wrote to memory of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 1804 wrote to memory of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 1804 wrote to memory of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 1804 wrote to memory of 3892 1804 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe PID 3892 wrote to memory of 2164 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe explorer.exe PID 3892 wrote to memory of 2164 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe explorer.exe PID 3892 wrote to memory of 2164 3892 75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe explorer.exe PID 2164 wrote to memory of 2504 2164 explorer.exe explorer.exe PID 2164 wrote to memory of 2504 2164 explorer.exe explorer.exe PID 2164 wrote to memory of 2504 2164 explorer.exe explorer.exe PID 2164 wrote to memory of 2504 2164 explorer.exe explorer.exe PID 2164 wrote to memory of 2504 2164 explorer.exe explorer.exe PID 2504 wrote to memory of 3240 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3240 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3240 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2280 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2280 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2280 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 5060 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 5060 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 5060 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1916 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1916 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1916 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4556 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4556 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4556 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1708 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1708 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1708 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 224 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 224 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 224 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 948 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 948 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 948 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2692 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2692 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2692 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3504 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3504 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3504 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4704 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4704 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4704 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1696 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1696 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 1696 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3032 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3032 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3032 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4320 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4320 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 4320 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2728 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2728 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 2728 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3896 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3896 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3896 2504 explorer.exe spoolsv.exe PID 2504 wrote to memory of 3016 2504 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75db9471f0b48fe06523042169d5efdc_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3240 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2312 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:1092 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2052 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4708 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:848 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3932 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3612 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3108 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:652 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2700 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3924 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1652 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4136 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3340 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1176 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2856
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1004 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5444
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2976
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:384
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2544
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3964
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3388
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5876
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6100
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4128
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5924
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2188
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5d677651e8cc876065054766e2832d365
SHA134035b91f4af6293d96321c15de2f842594c7537
SHA256c75bbeb16d48fb750d823c828b9e7451ac127c0629e82dce53ceb828610ddb2c
SHA512fa5a40474d5ce052af81059cdf5b95f6a69f3d62ee69025796bc6d56ab5e62cf20854e9514678a785276cde369bb429232530255fe740269a7cdcd3565898be5
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5f715da8fe123084a5231fe9afe730aab
SHA161658f95eec2cdaeb24de09b8dd5397db58f86f9
SHA2565491f4a93bca92648e0c1687f98b30c2ab6ddf1510c4c20caef43e2361e401b2
SHA512cb2fe8b21c25ef8c7e291440bf1d4b893edb220c60410835432f20dfd0638a9244910d94dd8c7f94e0884c884fcc98a55104fe249821b19691e773d4a057afbe
-
memory/224-1291-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/528-4145-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/928-2012-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/928-2015-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/948-1292-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/976-2004-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1092-3342-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1332-2030-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1544-4943-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1560-3007-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1588-2806-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1652-3089-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-1645-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1708-1130-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1768-2625-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1796-2023-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1804-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1804-0-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/1804-43-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/1804-48-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1916-2136-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1916-1128-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2124-2615-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2164-100-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2164-95-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2192-4951-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2192-4955-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2256-2019-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2280-2013-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2280-971-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2504-99-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2504-818-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-3896-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-3975-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2692-1440-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2700-2797-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2700-2958-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2728-1821-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2764-2125-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2768-2375-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2812-2185-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2816-2119-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2856-3453-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2856-3350-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2960-2087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2960-2005-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-3722-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2976-3655-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2988-3659-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3016-2003-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3032-1646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3108-2543-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3240-2006-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3240-819-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3340-2996-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3388-4354-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3464-3907-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3504-1441-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3652-4802-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3652-4797-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3892-47-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3892-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3892-89-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3896-1822-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3904-2195-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3908-2601-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3908-2606-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3932-2452-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3932-2577-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3964-4067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3964-4212-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4112-4781-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4160-2296-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-1820-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4556-1129-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4624-2018-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4700-2829-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-1644-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4708-2278-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4708-2434-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4760-2471-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4828-2596-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4960-2204-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5024-2462-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5028-2815-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5028-2818-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-2026-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5060-972-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5208-4808-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5364-4823-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5364-4819-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5408-4435-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5444-4831-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5444-4836-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5468-4843-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5468-4852-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5872-4539-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5876-4532-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5924-5016-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6100-4772-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6100-4998-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB