Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 10:50
Behavioral task
behavioral1
Sample
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a06369f18f6b9c517dddab1452b01e65
-
SHA1
5770384e62c77b16eed2e9beb41baed0ef4240e1
-
SHA256
ea890c43c7119f3b8c3755ecfe93cd356d0e4ebd3c1a14b0270e0ecd96811965
-
SHA512
3ef6f3ce1e46f84dfed983f0010a8029504de2d4d7313d66f06cb059b41f62a35b1f8003334210d5fc03ef7988fbdafc93082c8ea71022eaff40d7f82649aa22
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWwwX
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3056 explorer.exe 4264 explorer.exe 2068 spoolsv.exe 3752 spoolsv.exe 3032 spoolsv.exe 4020 spoolsv.exe 4132 spoolsv.exe 4640 spoolsv.exe 4976 spoolsv.exe 60 spoolsv.exe 1364 spoolsv.exe 2724 spoolsv.exe 3996 spoolsv.exe 3040 spoolsv.exe 3524 spoolsv.exe 4924 spoolsv.exe 5112 spoolsv.exe 4448 spoolsv.exe 2448 spoolsv.exe 1132 spoolsv.exe 4772 spoolsv.exe 752 spoolsv.exe 4412 spoolsv.exe 3908 spoolsv.exe 2972 spoolsv.exe 1028 spoolsv.exe 4956 spoolsv.exe 4556 spoolsv.exe 3436 spoolsv.exe 4668 spoolsv.exe 2176 spoolsv.exe 1480 spoolsv.exe 1276 spoolsv.exe 4036 spoolsv.exe 1396 spoolsv.exe 3520 spoolsv.exe 3024 spoolsv.exe 4536 spoolsv.exe 3648 explorer.exe 4784 spoolsv.exe 5060 spoolsv.exe 3360 spoolsv.exe 1568 spoolsv.exe 1736 spoolsv.exe 964 spoolsv.exe 512 spoolsv.exe 4816 spoolsv.exe 4432 spoolsv.exe 1232 spoolsv.exe 4468 explorer.exe 1992 spoolsv.exe 2712 spoolsv.exe 5104 spoolsv.exe 2228 spoolsv.exe 3776 spoolsv.exe 1968 spoolsv.exe 1152 spoolsv.exe 4596 spoolsv.exe 2952 explorer.exe 736 spoolsv.exe 3156 spoolsv.exe 2000 spoolsv.exe 4752 spoolsv.exe 4872 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 2956 set thread context of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 3056 set thread context of 4264 3056 explorer.exe explorer.exe PID 2068 set thread context of 4536 2068 spoolsv.exe spoolsv.exe PID 3752 set thread context of 4784 3752 spoolsv.exe spoolsv.exe PID 3032 set thread context of 3360 3032 spoolsv.exe spoolsv.exe PID 4020 set thread context of 1568 4020 spoolsv.exe spoolsv.exe PID 4132 set thread context of 1736 4132 spoolsv.exe spoolsv.exe PID 4640 set thread context of 964 4640 spoolsv.exe spoolsv.exe PID 4976 set thread context of 512 4976 spoolsv.exe spoolsv.exe PID 60 set thread context of 4816 60 spoolsv.exe spoolsv.exe PID 1364 set thread context of 4432 1364 spoolsv.exe spoolsv.exe PID 2724 set thread context of 1232 2724 spoolsv.exe spoolsv.exe PID 3996 set thread context of 2712 3996 spoolsv.exe spoolsv.exe PID 3040 set thread context of 5104 3040 spoolsv.exe spoolsv.exe PID 3524 set thread context of 2228 3524 spoolsv.exe spoolsv.exe PID 4924 set thread context of 3776 4924 spoolsv.exe spoolsv.exe PID 5112 set thread context of 1968 5112 spoolsv.exe spoolsv.exe PID 4448 set thread context of 1152 4448 spoolsv.exe spoolsv.exe PID 2448 set thread context of 4596 2448 spoolsv.exe spoolsv.exe PID 1132 set thread context of 3156 1132 spoolsv.exe spoolsv.exe PID 4772 set thread context of 2000 4772 spoolsv.exe spoolsv.exe PID 752 set thread context of 4752 752 spoolsv.exe spoolsv.exe PID 4412 set thread context of 4872 4412 spoolsv.exe spoolsv.exe PID 3908 set thread context of 2796 3908 spoolsv.exe spoolsv.exe PID 2972 set thread context of 4960 2972 spoolsv.exe spoolsv.exe PID 1028 set thread context of 1376 1028 spoolsv.exe spoolsv.exe PID 4956 set thread context of 1844 4956 spoolsv.exe spoolsv.exe PID 4556 set thread context of 2248 4556 spoolsv.exe spoolsv.exe PID 3436 set thread context of 4600 3436 spoolsv.exe spoolsv.exe PID 4668 set thread context of 4016 4668 spoolsv.exe spoolsv.exe PID 2176 set thread context of 3708 2176 spoolsv.exe spoolsv.exe PID 1480 set thread context of 2888 1480 spoolsv.exe spoolsv.exe PID 1276 set thread context of 4972 1276 spoolsv.exe spoolsv.exe PID 4036 set thread context of 2212 4036 spoolsv.exe spoolsv.exe PID 1396 set thread context of 4328 1396 spoolsv.exe spoolsv.exe PID 3520 set thread context of 2876 3520 spoolsv.exe spoolsv.exe PID 3024 set thread context of 1240 3024 spoolsv.exe spoolsv.exe PID 3648 set thread context of 2132 3648 explorer.exe explorer.exe PID 5060 set thread context of 936 5060 spoolsv.exe spoolsv.exe PID 4468 set thread context of 1592 4468 explorer.exe explorer.exe PID 1992 set thread context of 2576 1992 spoolsv.exe spoolsv.exe PID 736 set thread context of 5004 736 spoolsv.exe spoolsv.exe PID 2952 set thread context of 3588 2952 explorer.exe explorer.exe PID 1952 set thread context of 3680 1952 spoolsv.exe spoolsv.exe PID 4660 set thread context of 1008 4660 explorer.exe explorer.exe PID 1296 set thread context of 3316 1296 explorer.exe explorer.exe PID 4220 set thread context of 2736 4220 spoolsv.exe spoolsv.exe PID 4312 set thread context of 548 4312 spoolsv.exe spoolsv.exe PID 2660 set thread context of 2984 2660 explorer.exe explorer.exe PID 2064 set thread context of 2120 2064 spoolsv.exe spoolsv.exe PID 2872 set thread context of 2620 2872 spoolsv.exe spoolsv.exe PID 1360 set thread context of 3844 1360 explorer.exe explorer.exe PID 4936 set thread context of 2588 4936 spoolsv.exe spoolsv.exe PID 2688 set thread context of 2940 2688 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exea06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exeexplorer.exepid process 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4264 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4264 explorer.exe 4536 spoolsv.exe 4536 spoolsv.exe 4784 spoolsv.exe 4784 spoolsv.exe 3360 spoolsv.exe 3360 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 1736 spoolsv.exe 1736 spoolsv.exe 964 spoolsv.exe 964 spoolsv.exe 512 spoolsv.exe 512 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 4432 spoolsv.exe 4432 spoolsv.exe 1232 spoolsv.exe 1232 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 5104 spoolsv.exe 5104 spoolsv.exe 2228 spoolsv.exe 2228 spoolsv.exe 3776 spoolsv.exe 3776 spoolsv.exe 1968 spoolsv.exe 1968 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 4596 spoolsv.exe 4596 spoolsv.exe 3156 spoolsv.exe 3156 spoolsv.exe 2000 spoolsv.exe 2000 spoolsv.exe 4752 spoolsv.exe 4752 spoolsv.exe 4872 spoolsv.exe 4872 spoolsv.exe 2796 spoolsv.exe 2796 spoolsv.exe 4960 spoolsv.exe 4960 spoolsv.exe 1376 spoolsv.exe 1376 spoolsv.exe 1844 spoolsv.exe 1844 spoolsv.exe 2248 spoolsv.exe 2248 spoolsv.exe 4600 spoolsv.exe 4600 spoolsv.exe 4016 spoolsv.exe 4016 spoolsv.exe 3708 spoolsv.exe 3708 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exea06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2956 wrote to memory of 2892 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe splwow64.exe PID 2956 wrote to memory of 2892 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe splwow64.exe PID 2956 wrote to memory of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 2956 wrote to memory of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 2956 wrote to memory of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 2956 wrote to memory of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 2956 wrote to memory of 3960 2956 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe PID 3960 wrote to memory of 3056 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe explorer.exe PID 3960 wrote to memory of 3056 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe explorer.exe PID 3960 wrote to memory of 3056 3960 a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe explorer.exe PID 3056 wrote to memory of 4264 3056 explorer.exe explorer.exe PID 3056 wrote to memory of 4264 3056 explorer.exe explorer.exe PID 3056 wrote to memory of 4264 3056 explorer.exe explorer.exe PID 3056 wrote to memory of 4264 3056 explorer.exe explorer.exe PID 3056 wrote to memory of 4264 3056 explorer.exe explorer.exe PID 4264 wrote to memory of 2068 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2068 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2068 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3752 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3752 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3752 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3032 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3032 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3032 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4020 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4020 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4020 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4132 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4132 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4132 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4640 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4640 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4640 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4976 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4976 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4976 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 60 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 60 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 60 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 1364 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 1364 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 1364 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2724 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2724 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2724 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3996 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3996 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3996 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3040 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3040 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3040 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3524 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3524 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 3524 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4924 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4924 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4924 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 5112 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 5112 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 5112 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4448 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4448 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 4448 4264 explorer.exe spoolsv.exe PID 4264 wrote to memory of 2448 4264 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a06369f18f6b9c517dddab1452b01e65_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4536 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2132
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5104 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4596 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2952 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4752 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1376 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4660 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2248 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3708 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1296 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2876
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2660 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1240
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1360 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:936
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:652 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2576
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5004
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3680
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4488
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2736
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2120
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2588
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2192 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2940
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4524
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2252
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2388 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1840
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1608 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3536 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3212
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5292f91a508e14ef65eadd20b98365a85
SHA122820c6d0a105aca8d4caf65e17a284779f95fa6
SHA2561b989cf7198fbc62bc970a2562f7947c35f5983c9dbef4cabfbf0baf2d835275
SHA512fec5f48c1dd109da82c888200302b5b284feb3ff0e6ecd10952080c783843009d52f2e73ffe1ffc66ceb19fa429e8bb6393cff475595934d3f401fe20016f770
-
Filesize
2.2MB
MD5847c2b4853e48500da7cac6ee4edd799
SHA18fa12bf029b11cfa7858990077ac07c9c92ae600
SHA2568789d339459f7401be70c24b731342ab6b563e8b3a30dd0873ca9187b0e63048
SHA512762e1986e4e09199696460814066d2db8864c87df3635e62ed6153394dc3b069042152e6c142a05da29d10ad452110a9070585f8bb95d25222ce472c754885ab