Analysis
-
max time kernel
106s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 02:47
Behavioral task
behavioral1
Sample
6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe
-
Size
2.2MB
-
MD5
6135e8bfe2cb21b47da662936aaaf7e9
-
SHA1
0a1ff102b0215a7c836efab062074c6c5119503c
-
SHA256
aa95c64f909e4455100ecd9494bfed2bfc7bd262f3c31a1173f21c1a0a125ed9
-
SHA512
cd586171b5390be816127a806ea0e6bc4fed9107bbfe667868fc6ffba0b8c5c21ac2b44ce9d454c979d97035bd9fce6fadcf99dd7e9fdb19601b0bb3cb32aa66
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwo
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe -
Executes dropped EXE 55 IoCs
pid Process 3768 explorer.exe 4328 explorer.exe 1316 spoolsv.exe 2440 spoolsv.exe 4436 spoolsv.exe 988 spoolsv.exe 3828 spoolsv.exe 3300 spoolsv.exe 1016 spoolsv.exe 3892 spoolsv.exe 4808 spoolsv.exe 3392 spoolsv.exe 5044 spoolsv.exe 1088 spoolsv.exe 3832 spoolsv.exe 4912 spoolsv.exe 4020 spoolsv.exe 3096 spoolsv.exe 2544 spoolsv.exe 2696 spoolsv.exe 4372 spoolsv.exe 4888 spoolsv.exe 1428 spoolsv.exe 3572 spoolsv.exe 4860 explorer.exe 1048 spoolsv.exe 3800 spoolsv.exe 1240 explorer.exe 3128 spoolsv.exe 1556 spoolsv.exe 704 spoolsv.exe 1472 explorer.exe 3132 spoolsv.exe 928 spoolsv.exe 3460 spoolsv.exe 1912 explorer.exe 2008 spoolsv.exe 3028 spoolsv.exe 5096 spoolsv.exe 224 spoolsv.exe 3476 explorer.exe 3644 spoolsv.exe 1380 spoolsv.exe 1196 explorer.exe 960 spoolsv.exe 4772 spoolsv.exe 4060 explorer.exe 2260 spoolsv.exe 4564 spoolsv.exe 3288 spoolsv.exe 860 spoolsv.exe 1448 explorer.exe 3848 spoolsv.exe 216 spoolsv.exe 3516 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 4640 set thread context of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 3768 set thread context of 4328 3768 explorer.exe 97 PID 1316 set thread context of 3572 1316 spoolsv.exe 119 PID 2440 set thread context of 3800 2440 spoolsv.exe 122 PID 4436 set thread context of 1556 4436 spoolsv.exe 125 PID 988 set thread context of 704 988 spoolsv.exe 126 PID 3828 set thread context of 928 3828 spoolsv.exe 129 PID 3300 set thread context of 3460 3300 spoolsv.exe 130 PID 1016 set thread context of 3028 1016 spoolsv.exe 133 PID 3892 set thread context of 224 3892 spoolsv.exe 135 PID 4808 set thread context of 1380 4808 spoolsv.exe 138 PID 3392 set thread context of 4772 3392 spoolsv.exe 141 PID 5044 set thread context of 4564 5044 spoolsv.exe 144 PID 1088 set thread context of 860 1088 spoolsv.exe 146 PID 3832 set thread context of 216 3832 spoolsv.exe 149 -
Drops file in Windows directory 43 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 4328 explorer.exe 3572 spoolsv.exe 3572 spoolsv.exe 3800 spoolsv.exe 3800 spoolsv.exe 1556 spoolsv.exe 1556 spoolsv.exe 704 spoolsv.exe 704 spoolsv.exe 928 spoolsv.exe 928 spoolsv.exe 3460 spoolsv.exe 3460 spoolsv.exe 3028 spoolsv.exe 3028 spoolsv.exe 224 spoolsv.exe 224 spoolsv.exe 1380 spoolsv.exe 1380 spoolsv.exe 4772 spoolsv.exe 4772 spoolsv.exe 4564 spoolsv.exe 4564 spoolsv.exe 860 spoolsv.exe 860 spoolsv.exe 216 spoolsv.exe 216 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 220 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 82 PID 4640 wrote to memory of 220 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 82 PID 4640 wrote to memory of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 4640 wrote to memory of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 4640 wrote to memory of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 4640 wrote to memory of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 4640 wrote to memory of 1964 4640 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 94 PID 1964 wrote to memory of 3768 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 95 PID 1964 wrote to memory of 3768 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 95 PID 1964 wrote to memory of 3768 1964 6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe 95 PID 3768 wrote to memory of 4328 3768 explorer.exe 97 PID 3768 wrote to memory of 4328 3768 explorer.exe 97 PID 3768 wrote to memory of 4328 3768 explorer.exe 97 PID 3768 wrote to memory of 4328 3768 explorer.exe 97 PID 3768 wrote to memory of 4328 3768 explorer.exe 97 PID 4328 wrote to memory of 1316 4328 explorer.exe 98 PID 4328 wrote to memory of 1316 4328 explorer.exe 98 PID 4328 wrote to memory of 1316 4328 explorer.exe 98 PID 4328 wrote to memory of 2440 4328 explorer.exe 99 PID 4328 wrote to memory of 2440 4328 explorer.exe 99 PID 4328 wrote to memory of 2440 4328 explorer.exe 99 PID 4328 wrote to memory of 4436 4328 explorer.exe 100 PID 4328 wrote to memory of 4436 4328 explorer.exe 100 PID 4328 wrote to memory of 4436 4328 explorer.exe 100 PID 4328 wrote to memory of 988 4328 explorer.exe 101 PID 4328 wrote to memory of 988 4328 explorer.exe 101 PID 4328 wrote to memory of 988 4328 explorer.exe 101 PID 4328 wrote to memory of 3828 4328 explorer.exe 102 PID 4328 wrote to memory of 3828 4328 explorer.exe 102 PID 4328 wrote to memory of 3828 4328 explorer.exe 102 PID 4328 wrote to memory of 3300 4328 explorer.exe 103 PID 4328 wrote to memory of 3300 4328 explorer.exe 103 PID 4328 wrote to memory of 3300 4328 explorer.exe 103 PID 4328 wrote to memory of 1016 4328 explorer.exe 104 PID 4328 wrote to memory of 1016 4328 explorer.exe 104 PID 4328 wrote to memory of 1016 4328 explorer.exe 104 PID 4328 wrote to memory of 3892 4328 explorer.exe 105 PID 4328 wrote to memory of 3892 4328 explorer.exe 105 PID 4328 wrote to memory of 3892 4328 explorer.exe 105 PID 4328 wrote to memory of 4808 4328 explorer.exe 106 PID 4328 wrote to memory of 4808 4328 explorer.exe 106 PID 4328 wrote to memory of 4808 4328 explorer.exe 106 PID 4328 wrote to memory of 3392 4328 explorer.exe 107 PID 4328 wrote to memory of 3392 4328 explorer.exe 107 PID 4328 wrote to memory of 3392 4328 explorer.exe 107 PID 4328 wrote to memory of 5044 4328 explorer.exe 108 PID 4328 wrote to memory of 5044 4328 explorer.exe 108 PID 4328 wrote to memory of 5044 4328 explorer.exe 108 PID 4328 wrote to memory of 1088 4328 explorer.exe 109 PID 4328 wrote to memory of 1088 4328 explorer.exe 109 PID 4328 wrote to memory of 1088 4328 explorer.exe 109 PID 4328 wrote to memory of 3832 4328 explorer.exe 110 PID 4328 wrote to memory of 3832 4328 explorer.exe 110 PID 4328 wrote to memory of 3832 4328 explorer.exe 110 PID 4328 wrote to memory of 4912 4328 explorer.exe 111 PID 4328 wrote to memory of 4912 4328 explorer.exe 111 PID 4328 wrote to memory of 4912 4328 explorer.exe 111 PID 4328 wrote to memory of 4020 4328 explorer.exe 112 PID 4328 wrote to memory of 4020 4328 explorer.exe 112 PID 4328 wrote to memory of 4020 4328 explorer.exe 112 PID 4328 wrote to memory of 3096 4328 explorer.exe 113 PID 4328 wrote to memory of 3096 4328 explorer.exe 113 PID 4328 wrote to memory of 3096 4328 explorer.exe 113 PID 4328 wrote to memory of 2544 4328 explorer.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6135e8bfe2cb21b47da662936aaaf7e9JaffaCakes118_NeikiAnalytics.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3572 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4860 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:464
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3800 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:704 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1472 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3588
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3460 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1912 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4508
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3476 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5040
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3648
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4772 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4060 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3884
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1448 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2676
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:3516 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4316
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3716
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1952
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2912
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2672
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2872
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4184
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2508
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2556
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4160
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3584
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3916
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2952
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2636
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4416
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1700
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2928
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4400
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2592
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2096
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3780
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4656
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3744
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4580
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1708
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4584
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4344
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1012
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:628
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1812
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:624
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3036
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2704
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2280
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4500
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4812
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4768
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3124
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1948
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1168
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4464
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4208
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2032
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4632
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:384
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2892
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2736
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4956
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3140
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD56734885c1626be8ab3bcba1152b1c99b
SHA1b6d7e306600387a52a4cd3948796370e53487312
SHA256bf0b072c3e9fd37896c989d99e701a87af5a91f7c14a6085302d222357467894
SHA5121895b51179797e16d5ee3ddb255c22c9cfc37e9dd168974a647c40ab588788aa11c30f034dc09a2b82941bf8315fca9fa565fb3048eab26c85456855fc7b13be
-
Filesize
2.2MB
MD59b132a42f7bf3dc26b2501b62fa0712c
SHA1905c8789bd025d639d9b5336f7560d319fdcf177
SHA256afb05072101a393047883510c9807a7245b976de28d57daebcddd3e84a167d01
SHA512628bc3583711e701b28d89ca650b632d92c83bae00abfa45fb214c72af7012e9efa057d1bb412e4bff62ac9230047e9ebf77deb6602abd5e913b65423849d344