Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 22:46
Behavioral task
behavioral1
Sample
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe
-
Size
2.2MB
-
MD5
58e89a3c6eda16a6ee849585814ff408
-
SHA1
f1afbaf118598a5d986b3b9b1702a934c6d929ed
-
SHA256
705c5e09905a262ee2233a7296b17ab8f7ee03338517a70c0cc190d8a6e50c72
-
SHA512
456b7a6a848da5500cbc758fd6a852f5ee205edd4134dea6fc4f8bdcb019fa9a6e415eb5dc2d32353fbecdafdb455346acb738632d69efe7b29b61f379623d52
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZK:0UzeyQMS4DqodCnoe+iitjWww2
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 964 explorer.exe 4704 explorer.exe 3244 spoolsv.exe 1284 spoolsv.exe 1408 spoolsv.exe 1560 spoolsv.exe 1548 spoolsv.exe 3476 spoolsv.exe 4996 spoolsv.exe 1416 spoolsv.exe 64 spoolsv.exe 2888 spoolsv.exe 2688 spoolsv.exe 3744 spoolsv.exe 3916 spoolsv.exe 4468 spoolsv.exe 3720 spoolsv.exe 4924 spoolsv.exe 2416 spoolsv.exe 1788 spoolsv.exe 1660 spoolsv.exe 4740 spoolsv.exe 4912 spoolsv.exe 116 spoolsv.exe 1352 spoolsv.exe 4084 spoolsv.exe 3380 spoolsv.exe 1336 spoolsv.exe 540 spoolsv.exe 5056 spoolsv.exe 3716 spoolsv.exe 2156 explorer.exe 3348 spoolsv.exe 2820 spoolsv.exe 1848 spoolsv.exe 2172 spoolsv.exe 1568 spoolsv.exe 2180 explorer.exe 3172 spoolsv.exe 1452 spoolsv.exe 4608 spoolsv.exe 4800 spoolsv.exe 2780 spoolsv.exe 744 explorer.exe 3216 spoolsv.exe 856 spoolsv.exe 2916 spoolsv.exe 1348 spoolsv.exe 4056 spoolsv.exe 3036 spoolsv.exe 3344 explorer.exe 4612 spoolsv.exe 5116 spoolsv.exe 1912 spoolsv.exe 532 spoolsv.exe 4060 explorer.exe 1844 spoolsv.exe 2672 spoolsv.exe 1192 spoolsv.exe 2676 spoolsv.exe 4464 spoolsv.exe 4528 explorer.exe 3696 spoolsv.exe 4392 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 41 IoCs
Processes:
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 3568 set thread context of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 964 set thread context of 4704 964 explorer.exe explorer.exe PID 3244 set thread context of 3716 3244 spoolsv.exe spoolsv.exe PID 1284 set thread context of 3348 1284 spoolsv.exe spoolsv.exe PID 1408 set thread context of 1848 1408 spoolsv.exe spoolsv.exe PID 1560 set thread context of 2172 1560 spoolsv.exe spoolsv.exe PID 1548 set thread context of 1568 1548 spoolsv.exe spoolsv.exe PID 3476 set thread context of 3172 3476 spoolsv.exe spoolsv.exe PID 4996 set thread context of 1452 4996 spoolsv.exe spoolsv.exe PID 1416 set thread context of 4800 1416 spoolsv.exe spoolsv.exe PID 64 set thread context of 2780 64 spoolsv.exe spoolsv.exe PID 2888 set thread context of 3216 2888 spoolsv.exe spoolsv.exe PID 2688 set thread context of 2916 2688 spoolsv.exe spoolsv.exe PID 3744 set thread context of 1348 3744 spoolsv.exe spoolsv.exe PID 3916 set thread context of 3036 3916 spoolsv.exe spoolsv.exe PID 4468 set thread context of 4612 4468 spoolsv.exe spoolsv.exe PID 3720 set thread context of 1912 3720 spoolsv.exe spoolsv.exe PID 4924 set thread context of 532 4924 spoolsv.exe spoolsv.exe PID 2416 set thread context of 1844 2416 spoolsv.exe spoolsv.exe PID 1788 set thread context of 1192 1788 spoolsv.exe spoolsv.exe PID 1660 set thread context of 2676 1660 spoolsv.exe spoolsv.exe PID 4740 set thread context of 4464 4740 spoolsv.exe spoolsv.exe PID 4912 set thread context of 4392 4912 spoolsv.exe spoolsv.exe PID 116 set thread context of 4516 116 spoolsv.exe spoolsv.exe PID 1352 set thread context of 4884 1352 spoolsv.exe spoolsv.exe PID 4084 set thread context of 3292 4084 spoolsv.exe spoolsv.exe PID 3380 set thread context of 4532 3380 spoolsv.exe spoolsv.exe PID 1336 set thread context of 5076 1336 spoolsv.exe spoolsv.exe PID 540 set thread context of 2540 540 spoolsv.exe spoolsv.exe PID 5056 set thread context of 1440 5056 spoolsv.exe spoolsv.exe PID 2156 set thread context of 3140 2156 explorer.exe explorer.exe PID 2820 set thread context of 4896 2820 spoolsv.exe spoolsv.exe PID 2180 set thread context of 3968 2180 explorer.exe explorer.exe PID 4608 set thread context of 3496 4608 spoolsv.exe spoolsv.exe PID 744 set thread context of 864 744 explorer.exe explorer.exe PID 856 set thread context of 1608 856 spoolsv.exe spoolsv.exe PID 4056 set thread context of 5260 4056 spoolsv.exe spoolsv.exe PID 3344 set thread context of 5660 3344 explorer.exe explorer.exe PID 5116 set thread context of 5148 5116 spoolsv.exe spoolsv.exe PID 4060 set thread context of 5592 4060 explorer.exe explorer.exe PID 2672 set thread context of 5208 2672 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exe58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exeexplorer.exepid process 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4704 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 3716 spoolsv.exe 3716 spoolsv.exe 3348 spoolsv.exe 3348 spoolsv.exe 1848 spoolsv.exe 1848 spoolsv.exe 2172 spoolsv.exe 2172 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 3172 spoolsv.exe 3172 spoolsv.exe 1452 spoolsv.exe 1452 spoolsv.exe 4800 spoolsv.exe 4800 spoolsv.exe 2780 spoolsv.exe 2780 spoolsv.exe 3216 spoolsv.exe 3216 spoolsv.exe 2916 spoolsv.exe 2916 spoolsv.exe 1348 spoolsv.exe 1348 spoolsv.exe 3036 spoolsv.exe 3036 spoolsv.exe 4612 spoolsv.exe 4612 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe 532 spoolsv.exe 532 spoolsv.exe 1844 spoolsv.exe 1844 spoolsv.exe 1192 spoolsv.exe 1192 spoolsv.exe 2676 spoolsv.exe 2676 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 4392 spoolsv.exe 4392 spoolsv.exe 4516 spoolsv.exe 4516 spoolsv.exe 4884 spoolsv.exe 4884 spoolsv.exe 3292 spoolsv.exe 3292 spoolsv.exe 4532 spoolsv.exe 4532 spoolsv.exe 5076 spoolsv.exe 5076 spoolsv.exe 2540 spoolsv.exe 2540 spoolsv.exe 1440 spoolsv.exe 1440 spoolsv.exe 3140 explorer.exe 3140 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3568 wrote to memory of 4092 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe splwow64.exe PID 3568 wrote to memory of 4092 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe splwow64.exe PID 3568 wrote to memory of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 3568 wrote to memory of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 3568 wrote to memory of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 3568 wrote to memory of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 3568 wrote to memory of 3032 3568 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe PID 3032 wrote to memory of 964 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe explorer.exe PID 3032 wrote to memory of 964 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe explorer.exe PID 3032 wrote to memory of 964 3032 58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe explorer.exe PID 964 wrote to memory of 4704 964 explorer.exe explorer.exe PID 964 wrote to memory of 4704 964 explorer.exe explorer.exe PID 964 wrote to memory of 4704 964 explorer.exe explorer.exe PID 964 wrote to memory of 4704 964 explorer.exe explorer.exe PID 964 wrote to memory of 4704 964 explorer.exe explorer.exe PID 4704 wrote to memory of 3244 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3244 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3244 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1284 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1284 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1284 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1408 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1408 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1408 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1560 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1560 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1560 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1548 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1548 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1548 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3476 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3476 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3476 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4996 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4996 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4996 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1416 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1416 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 1416 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 64 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 64 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 64 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2888 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2888 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2888 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2688 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2688 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2688 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3744 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3744 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3744 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3916 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3916 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3916 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4468 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4468 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4468 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3720 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3720 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 3720 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4924 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4924 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 4924 4704 explorer.exe spoolsv.exe PID 4704 wrote to memory of 2416 4704 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\58e89a3c6eda16a6ee849585814ff408JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3716 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2156 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:3140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2180 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:64 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:744 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2916 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3036 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3344 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:532 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4060 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4464 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4528 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3292 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1128
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5076 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2540 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3112 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1440 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1244 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5472
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4896
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1120 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5176
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3496
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1608
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5260
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5300 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5148
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5208
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2124
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4892
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6124
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5460
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6128
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3604
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5788
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:924 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6048
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4980
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5b8d2b7d6b6a22e3e9541cb36263a0185
SHA107b4c4aa798e8c212910f03c05695217692440a3
SHA256f59a41af83477c0980e085a40b9acaa94ead9f9ad790cc2512eb87695baa45e2
SHA5124d99066b8bc6fa4c39d44d92bf0e379d500ed5401a888afc2e61b3c2f72155e5e2571be9d6a542ef12f6a8652a83cbea98218223baf5674a3f739c700f0fa442
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5f25e93486d60ef2629c5884edf1c4d99
SHA1a6daff70dd59eec1c2b8f3738e49be57a61fbea1
SHA256090d8e02fa8d5ea0b725faffe56a51a38ef301b8efffe5addc5b615fce8d3157
SHA51290cc84faeaad1d34e52e21c511cab3161cd8254e09efcaf5fba68207d9175fcabed4d4e1d74694d54ca4fda98b0bea3559391a3d532d30a9eacebcf9c3f48890
-
memory/64-1287-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/532-2878-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/532-2727-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/672-5575-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/864-4212-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/964-84-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/964-89-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1192-2799-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1192-2796-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1284-1911-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1284-960-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1348-2390-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1408-1998-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1408-961-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1416-1286-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1440-3484-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1452-2085-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1548-1093-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1560-2010-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1560-962-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1568-2247-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1568-2061-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1608-4221-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1608-4328-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1660-1910-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1788-1900-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1844-2735-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1848-1997-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1912-2632-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1912-2628-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2124-5080-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2124-5178-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2172-2007-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2416-1899-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2540-3411-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2540-3343-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-2818-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2676-2861-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2688-1441-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2780-2266-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2780-2440-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2888-1440-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2916-2379-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3032-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3032-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3032-72-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/3032-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3036-2709-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3036-2536-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3140-3719-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3140-3716-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3172-2075-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3216-2276-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3244-844-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3244-1902-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3292-3096-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3292-3325-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3348-1912-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3476-1094-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3496-4191-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3568-0-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/3568-28-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/3568-32-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3568-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3604-5553-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3716-2048-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3716-1901-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3720-1810-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3744-1442-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3916-1631-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3968-4035-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4392-2982-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4464-2899-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4468-1632-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4516-2991-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-88-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-843-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4740-1996-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4760-5013-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4800-2176-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4816-5566-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4884-3000-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4896-3804-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4896-3928-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4912-2009-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4924-1811-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4996-1095-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5076-3170-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5148-4704-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5148-4565-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5176-5414-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5200-5425-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5200-5420-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5208-4800-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5208-4918-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5260-4477-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5260-4348-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5268-5254-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5432-5261-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5460-5273-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5472-5284-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5592-4642-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5660-4429-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5660-4427-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5680-5293-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6124-5228-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6128-5401-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6128-5533-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB