Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 10:36
Behavioral task
behavioral1
Sample
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a058f4e2e8d8097b555983ef944d43de
-
SHA1
96eee644c168728821d24d16fa9e57360220c65b
-
SHA256
1057a85cfc7393f81f0a8cb66c08a277d61bda65fe61ca5017c5437346ed48ec
-
SHA512
a7a7f422d4ff28a2c7a4453df399a6f57270fc044e5e32c180d2d98e597bf13c922ee811404770a511e1ace03944667239b508dab1e2039332f36acefcab7ead
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwI
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3824 explorer.exe 640 explorer.exe 3400 spoolsv.exe 532 spoolsv.exe 4092 spoolsv.exe 2532 spoolsv.exe 5380 spoolsv.exe 4596 spoolsv.exe 2080 spoolsv.exe 5604 spoolsv.exe 644 spoolsv.exe 4200 spoolsv.exe 5180 spoolsv.exe 4536 spoolsv.exe 4852 spoolsv.exe 224 spoolsv.exe 4476 spoolsv.exe 2340 spoolsv.exe 976 spoolsv.exe 3548 spoolsv.exe 4292 spoolsv.exe 5464 spoolsv.exe 4624 spoolsv.exe 2736 spoolsv.exe 1160 spoolsv.exe 3240 spoolsv.exe 852 spoolsv.exe 3156 spoolsv.exe 6040 spoolsv.exe 2628 spoolsv.exe 2572 spoolsv.exe 3892 spoolsv.exe 1796 spoolsv.exe 4548 spoolsv.exe 4708 spoolsv.exe 4468 spoolsv.exe 5888 spoolsv.exe 2144 spoolsv.exe 4652 explorer.exe 2028 spoolsv.exe 3664 spoolsv.exe 928 spoolsv.exe 3184 spoolsv.exe 1304 spoolsv.exe 4364 spoolsv.exe 3616 spoolsv.exe 5768 spoolsv.exe 4192 explorer.exe 2716 spoolsv.exe 5848 spoolsv.exe 5344 spoolsv.exe 4912 spoolsv.exe 4984 spoolsv.exe 1036 spoolsv.exe 3508 spoolsv.exe 4896 spoolsv.exe 5480 explorer.exe 5704 spoolsv.exe 1476 spoolsv.exe 1412 spoolsv.exe 4768 spoolsv.exe 2540 spoolsv.exe 1672 spoolsv.exe 4664 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 58 IoCs
Processes:
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 5648 set thread context of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 3824 set thread context of 640 3824 explorer.exe explorer.exe PID 3400 set thread context of 2144 3400 spoolsv.exe spoolsv.exe PID 532 set thread context of 2028 532 spoolsv.exe spoolsv.exe PID 4092 set thread context of 928 4092 spoolsv.exe spoolsv.exe PID 2532 set thread context of 3184 2532 spoolsv.exe spoolsv.exe PID 5380 set thread context of 1304 5380 spoolsv.exe spoolsv.exe PID 4596 set thread context of 4364 4596 spoolsv.exe spoolsv.exe PID 2080 set thread context of 3616 2080 spoolsv.exe spoolsv.exe PID 5604 set thread context of 5768 5604 spoolsv.exe spoolsv.exe PID 644 set thread context of 2716 644 spoolsv.exe spoolsv.exe PID 4200 set thread context of 5344 4200 spoolsv.exe spoolsv.exe PID 5180 set thread context of 4912 5180 spoolsv.exe spoolsv.exe PID 4536 set thread context of 4984 4536 spoolsv.exe spoolsv.exe PID 4852 set thread context of 1036 4852 spoolsv.exe spoolsv.exe PID 224 set thread context of 3508 224 spoolsv.exe spoolsv.exe PID 4476 set thread context of 4896 4476 spoolsv.exe spoolsv.exe PID 2340 set thread context of 1476 2340 spoolsv.exe spoolsv.exe PID 976 set thread context of 1412 976 spoolsv.exe spoolsv.exe PID 3548 set thread context of 4768 3548 spoolsv.exe spoolsv.exe PID 4292 set thread context of 2540 4292 spoolsv.exe spoolsv.exe PID 5464 set thread context of 1672 5464 spoolsv.exe spoolsv.exe PID 4624 set thread context of 4664 4624 spoolsv.exe spoolsv.exe PID 2736 set thread context of 5980 2736 spoolsv.exe spoolsv.exe PID 1160 set thread context of 1956 1160 spoolsv.exe spoolsv.exe PID 3240 set thread context of 3936 3240 spoolsv.exe spoolsv.exe PID 852 set thread context of 5516 852 spoolsv.exe spoolsv.exe PID 3156 set thread context of 3580 3156 spoolsv.exe spoolsv.exe PID 6040 set thread context of 4940 6040 spoolsv.exe spoolsv.exe PID 2628 set thread context of 5996 2628 spoolsv.exe spoolsv.exe PID 2572 set thread context of 5100 2572 spoolsv.exe spoolsv.exe PID 3892 set thread context of 1480 3892 spoolsv.exe spoolsv.exe PID 1796 set thread context of 452 1796 spoolsv.exe spoolsv.exe PID 4548 set thread context of 1092 4548 spoolsv.exe spoolsv.exe PID 4708 set thread context of 3256 4708 spoolsv.exe spoolsv.exe PID 4468 set thread context of 2544 4468 spoolsv.exe spoolsv.exe PID 5888 set thread context of 2112 5888 spoolsv.exe spoolsv.exe PID 4652 set thread context of 3520 4652 explorer.exe explorer.exe PID 3664 set thread context of 944 3664 spoolsv.exe spoolsv.exe PID 4192 set thread context of 5444 4192 explorer.exe explorer.exe PID 5848 set thread context of 1748 5848 spoolsv.exe spoolsv.exe PID 5480 set thread context of 4328 5480 explorer.exe explorer.exe PID 5704 set thread context of 2380 5704 spoolsv.exe spoolsv.exe PID 4848 set thread context of 5860 4848 explorer.exe explorer.exe PID 3264 set thread context of 5288 3264 spoolsv.exe spoolsv.exe PID 408 set thread context of 5864 408 spoolsv.exe spoolsv.exe PID 3196 set thread context of 5408 3196 explorer.exe explorer.exe PID 2856 set thread context of 5772 2856 spoolsv.exe spoolsv.exe PID 3356 set thread context of 5692 3356 explorer.exe explorer.exe PID 592 set thread context of 1404 592 spoolsv.exe spoolsv.exe PID 3176 set thread context of 1456 3176 explorer.exe explorer.exe PID 1516 set thread context of 5328 1516 spoolsv.exe spoolsv.exe PID 5148 set thread context of 3396 5148 spoolsv.exe spoolsv.exe PID 3976 set thread context of 5472 3976 spoolsv.exe spoolsv.exe PID 4588 set thread context of 6008 4588 spoolsv.exe spoolsv.exe PID 3912 set thread context of 2484 3912 explorer.exe explorer.exe PID 2796 set thread context of 2508 2796 spoolsv.exe spoolsv.exe PID 1780 set thread context of 3484 1780 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exea058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exeexplorer.exepid process 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 640 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 640 explorer.exe 2144 spoolsv.exe 2144 spoolsv.exe 2028 spoolsv.exe 2028 spoolsv.exe 928 spoolsv.exe 928 spoolsv.exe 3184 spoolsv.exe 3184 spoolsv.exe 1304 spoolsv.exe 1304 spoolsv.exe 4364 spoolsv.exe 4364 spoolsv.exe 3616 spoolsv.exe 3616 spoolsv.exe 5768 spoolsv.exe 5768 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 5344 spoolsv.exe 5344 spoolsv.exe 4912 spoolsv.exe 4912 spoolsv.exe 4984 spoolsv.exe 4984 spoolsv.exe 1036 spoolsv.exe 1036 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 1476 spoolsv.exe 1476 spoolsv.exe 1412 spoolsv.exe 1412 spoolsv.exe 4768 spoolsv.exe 4768 spoolsv.exe 2540 spoolsv.exe 2540 spoolsv.exe 1672 spoolsv.exe 1672 spoolsv.exe 4664 spoolsv.exe 4664 spoolsv.exe 5980 spoolsv.exe 5980 spoolsv.exe 1956 spoolsv.exe 1956 spoolsv.exe 3936 spoolsv.exe 3936 spoolsv.exe 5516 spoolsv.exe 5516 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 4940 spoolsv.exe 4940 spoolsv.exe 5996 spoolsv.exe 5996 spoolsv.exe 5100 spoolsv.exe 5100 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exea058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 5648 wrote to memory of 3888 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe splwow64.exe PID 5648 wrote to memory of 3888 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe splwow64.exe PID 5648 wrote to memory of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 5648 wrote to memory of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 5648 wrote to memory of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 5648 wrote to memory of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 5648 wrote to memory of 1108 5648 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe PID 1108 wrote to memory of 3824 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe explorer.exe PID 1108 wrote to memory of 3824 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe explorer.exe PID 1108 wrote to memory of 3824 1108 a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe explorer.exe PID 3824 wrote to memory of 640 3824 explorer.exe explorer.exe PID 3824 wrote to memory of 640 3824 explorer.exe explorer.exe PID 3824 wrote to memory of 640 3824 explorer.exe explorer.exe PID 3824 wrote to memory of 640 3824 explorer.exe explorer.exe PID 3824 wrote to memory of 640 3824 explorer.exe explorer.exe PID 640 wrote to memory of 3400 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 3400 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 3400 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4092 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4092 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4092 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2532 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5380 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5380 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5380 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4596 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4596 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4596 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2080 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2080 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2080 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5604 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5604 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5604 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 644 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 644 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 644 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4200 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4200 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4200 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5180 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5180 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 5180 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4536 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4536 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4536 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4852 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4852 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4852 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 224 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 224 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 224 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4476 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4476 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 4476 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2340 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2340 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 2340 640 explorer.exe spoolsv.exe PID 640 wrote to memory of 976 640 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a058f4e2e8d8097b555983ef944d43de_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4652 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3520
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1304 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4192 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5444
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4984 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4896 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5480 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4664 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4848 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5860
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3240 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3156 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3580 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3196 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:452
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3356 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5692
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3176 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:944
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3912 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1748
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3476
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2380
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5288
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5864
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5772
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1404
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5196 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5472
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6008
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2508
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3680
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5560
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2536 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5320 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1684 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3612
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5856
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5cfceaa0e81029aad999c7c00b8da44ac
SHA1e217857b069eb0b1f810f4f11cad659bc6dcb715
SHA256576a81c1649f087ad8f6f2c36b203a07fc641762c79898878daa7b585dc299ae
SHA5126b33dbb84db4146125a0e995d125cb3ad24b3229858b1f76b19a36959ac0fdcce41ae06137aa7e37e9dee6d1eac6fee75250e7f6c4b4903fa58ddc19083e3804
-
Filesize
2.2MB
MD5d6846ee667e54eb78b13fa66b458342d
SHA16613889a0d8d79fcd0f8369acdde1081182f2c06
SHA25677515ae99e7bcca073922f323af35a0e78eac87d521fac9e70ca72f761fc8c8b
SHA512a6e5c047ad828e0d61f703274fcd36820859100c28a27f9c3b4035deee67e22c58388a3a1f96196e1c70cc06766f9d25c84f5fb4e27591804cb6dd9818de0bb3