Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:56
Behavioral task
behavioral1
Sample
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0959064eca970d6c24b7348719124a6
-
SHA1
917a653c95a42824a81c743e3ef1d34e0c61bf57
-
SHA256
d6dfe8a36bd90cd2a811757ac66cec546b584170346a6d4dad482068014608d8
-
SHA512
003eac0147e31ed6d5856dc0b58f7f841d2b5d4c6463ee8652bd5f44b945dbd95d24cea1cc987c957a2e88d6eefe85687993c3dad9cb08b53120ccaeb923f9f2
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwc
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4176 explorer.exe 2604 explorer.exe 892 spoolsv.exe 4388 spoolsv.exe 1756 spoolsv.exe 3700 spoolsv.exe 4336 spoolsv.exe 3956 spoolsv.exe 5104 spoolsv.exe 3988 spoolsv.exe 1652 spoolsv.exe 2476 spoolsv.exe 4812 spoolsv.exe 4100 spoolsv.exe 2256 spoolsv.exe 1456 spoolsv.exe 4792 spoolsv.exe 1504 spoolsv.exe 1464 spoolsv.exe 2012 spoolsv.exe 1392 spoolsv.exe 1720 spoolsv.exe 2080 spoolsv.exe 4024 spoolsv.exe 2056 spoolsv.exe 3312 spoolsv.exe 1944 spoolsv.exe 2680 spoolsv.exe 392 spoolsv.exe 2112 spoolsv.exe 5028 spoolsv.exe 5328 spoolsv.exe 5432 spoolsv.exe 5504 explorer.exe 5540 spoolsv.exe 5640 spoolsv.exe 5936 spoolsv.exe 5996 spoolsv.exe 5300 spoolsv.exe 5368 explorer.exe 5412 spoolsv.exe 5492 spoolsv.exe 5812 spoolsv.exe 5924 spoolsv.exe 5188 spoolsv.exe 3948 explorer.exe 5292 spoolsv.exe 4584 spoolsv.exe 5480 spoolsv.exe 5500 spoolsv.exe 5784 spoolsv.exe 6052 spoolsv.exe 6136 explorer.exe 6072 spoolsv.exe 5160 spoolsv.exe 5352 spoolsv.exe 5636 spoolsv.exe 5880 spoolsv.exe 5896 explorer.exe 6004 spoolsv.exe 6028 spoolsv.exe 5340 spoolsv.exe 3284 spoolsv.exe 5664 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 53 IoCs
Processes:
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 3248 set thread context of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 4176 set thread context of 2604 4176 explorer.exe explorer.exe PID 892 set thread context of 5432 892 spoolsv.exe spoolsv.exe PID 4388 set thread context of 5540 4388 spoolsv.exe spoolsv.exe PID 1756 set thread context of 5640 1756 spoolsv.exe spoolsv.exe PID 3700 set thread context of 5996 3700 spoolsv.exe spoolsv.exe PID 4336 set thread context of 5300 4336 spoolsv.exe spoolsv.exe PID 3956 set thread context of 5412 3956 spoolsv.exe spoolsv.exe PID 5104 set thread context of 5492 5104 spoolsv.exe spoolsv.exe PID 3988 set thread context of 5924 3988 spoolsv.exe spoolsv.exe PID 1652 set thread context of 5188 1652 spoolsv.exe spoolsv.exe PID 2476 set thread context of 5292 2476 spoolsv.exe spoolsv.exe PID 4812 set thread context of 4584 4812 spoolsv.exe spoolsv.exe PID 4100 set thread context of 5480 4100 spoolsv.exe spoolsv.exe PID 2256 set thread context of 5500 2256 spoolsv.exe spoolsv.exe PID 1456 set thread context of 6052 1456 spoolsv.exe spoolsv.exe PID 4792 set thread context of 6072 4792 spoolsv.exe spoolsv.exe PID 1504 set thread context of 5160 1504 spoolsv.exe spoolsv.exe PID 1464 set thread context of 5352 1464 spoolsv.exe spoolsv.exe PID 2012 set thread context of 5880 2012 spoolsv.exe spoolsv.exe PID 1392 set thread context of 6004 1392 spoolsv.exe spoolsv.exe PID 1720 set thread context of 6028 1720 spoolsv.exe spoolsv.exe PID 2080 set thread context of 3284 2080 spoolsv.exe spoolsv.exe PID 4024 set thread context of 5664 4024 spoolsv.exe spoolsv.exe PID 2056 set thread context of 5836 2056 spoolsv.exe spoolsv.exe PID 3312 set thread context of 588 3312 spoolsv.exe spoolsv.exe PID 1944 set thread context of 5324 1944 spoolsv.exe spoolsv.exe PID 2680 set thread context of 2296 2680 spoolsv.exe spoolsv.exe PID 392 set thread context of 3656 392 spoolsv.exe spoolsv.exe PID 2112 set thread context of 5600 2112 spoolsv.exe spoolsv.exe PID 5028 set thread context of 5972 5028 spoolsv.exe spoolsv.exe PID 5328 set thread context of 2288 5328 spoolsv.exe spoolsv.exe PID 5504 set thread context of 4344 5504 explorer.exe explorer.exe PID 5936 set thread context of 5884 5936 spoolsv.exe spoolsv.exe PID 5368 set thread context of 5512 5368 explorer.exe explorer.exe PID 5812 set thread context of 4948 5812 spoolsv.exe spoolsv.exe PID 3948 set thread context of 1288 3948 explorer.exe explorer.exe PID 6136 set thread context of 6064 6136 explorer.exe explorer.exe PID 5784 set thread context of 5928 5784 spoolsv.exe spoolsv.exe PID 5636 set thread context of 5172 5636 spoolsv.exe spoolsv.exe PID 5896 set thread context of 5484 5896 explorer.exe explorer.exe PID 5340 set thread context of 5036 5340 spoolsv.exe spoolsv.exe PID 3660 set thread context of 4376 3660 explorer.exe explorer.exe PID 5236 set thread context of 5916 5236 spoolsv.exe spoolsv.exe PID 1608 set thread context of 3836 1608 explorer.exe explorer.exe PID 2400 set thread context of 3972 2400 spoolsv.exe spoolsv.exe PID 4188 set thread context of 5040 4188 spoolsv.exe spoolsv.exe PID 5440 set thread context of 2060 5440 spoolsv.exe spoolsv.exe PID 636 set thread context of 1068 636 explorer.exe explorer.exe PID 2780 set thread context of 5248 2780 spoolsv.exe spoolsv.exe PID 1832 set thread context of 3492 1832 explorer.exe explorer.exe PID 660 set thread context of 5240 660 spoolsv.exe spoolsv.exe PID 3152 set thread context of 5376 3152 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exeexplorer.exepid process 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2604 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 2604 explorer.exe 5432 spoolsv.exe 5432 spoolsv.exe 5540 spoolsv.exe 5540 spoolsv.exe 5640 spoolsv.exe 5640 spoolsv.exe 5996 spoolsv.exe 5996 spoolsv.exe 5300 spoolsv.exe 5300 spoolsv.exe 5412 spoolsv.exe 5412 spoolsv.exe 5492 spoolsv.exe 5492 spoolsv.exe 5924 spoolsv.exe 5924 spoolsv.exe 5188 spoolsv.exe 5188 spoolsv.exe 5292 spoolsv.exe 5292 spoolsv.exe 4584 spoolsv.exe 4584 spoolsv.exe 5480 spoolsv.exe 5480 spoolsv.exe 5500 spoolsv.exe 5500 spoolsv.exe 6052 spoolsv.exe 6052 spoolsv.exe 6072 spoolsv.exe 6072 spoolsv.exe 5160 spoolsv.exe 5160 spoolsv.exe 5352 spoolsv.exe 5352 spoolsv.exe 5880 spoolsv.exe 5880 spoolsv.exe 6004 spoolsv.exe 6004 spoolsv.exe 6028 spoolsv.exe 6028 spoolsv.exe 3284 spoolsv.exe 3284 spoolsv.exe 5664 spoolsv.exe 5664 spoolsv.exe 5836 spoolsv.exe 5836 spoolsv.exe 588 spoolsv.exe 588 spoolsv.exe 5324 spoolsv.exe 5324 spoolsv.exe 2296 spoolsv.exe 2296 spoolsv.exe 3656 spoolsv.exe 3656 spoolsv.exe 5600 spoolsv.exe 5600 spoolsv.exe 5972 spoolsv.exe 5972 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0959064eca970d6c24b7348719124a6_JaffaCakes118.exea0959064eca970d6c24b7348719124a6_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3248 wrote to memory of 1896 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe splwow64.exe PID 3248 wrote to memory of 1896 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe splwow64.exe PID 3248 wrote to memory of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 3248 wrote to memory of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 3248 wrote to memory of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 3248 wrote to memory of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 3248 wrote to memory of 3408 3248 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe PID 3408 wrote to memory of 4176 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe explorer.exe PID 3408 wrote to memory of 4176 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe explorer.exe PID 3408 wrote to memory of 4176 3408 a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe explorer.exe PID 4176 wrote to memory of 2604 4176 explorer.exe explorer.exe PID 4176 wrote to memory of 2604 4176 explorer.exe explorer.exe PID 4176 wrote to memory of 2604 4176 explorer.exe explorer.exe PID 4176 wrote to memory of 2604 4176 explorer.exe explorer.exe PID 4176 wrote to memory of 2604 4176 explorer.exe explorer.exe PID 2604 wrote to memory of 892 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 892 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 892 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4388 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4388 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4388 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1756 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1756 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1756 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3700 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3700 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3700 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4336 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4336 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4336 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3956 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3956 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3956 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 5104 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 5104 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 5104 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3988 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3988 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 3988 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1652 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1652 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1652 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2476 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2476 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2476 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4812 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4812 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4812 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4100 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4100 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4100 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2256 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2256 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 2256 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1456 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1456 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1456 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4792 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4792 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 4792 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1504 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1504 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1504 2604 explorer.exe spoolsv.exe PID 2604 wrote to memory of 1464 2604 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0959064eca970d6c24b7348719124a6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5432 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5504 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5300 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5368 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5924 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5188 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3948 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6052 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6136 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:6064
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6072 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5880 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5896 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5664 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3660 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3656 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1608 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2288
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1068
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1832 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3492
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4948
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2168 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5928
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5172
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5036
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:5236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5916
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4188 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5040
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2060
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5248
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:428
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5684 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:81⤵PID:1044
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD57e512aebe8b0b2e64ecacfb5c4445243
SHA14c2777adb21cb9e39fe534bff763490d694c70b2
SHA25640b501371cfbee36b18b501c9b67c9f8ee4db81e062b00d4d50ff668911c999c
SHA5128431dff8181342fdee3d2b75466ab7ce29dbc3e9594c16327df91658f90cc165c57b9ebbd39d73aca45b2bd6e04b98a441886920c94ba376d4c174b18af15c84
-
Filesize
2.2MB
MD581573c53b5c200e563c4125ab47a283f
SHA1e139c38822df9b22164febf96abb67d4b01beac0
SHA256a4d958dbd26b93ece84cdef43912563b4dbe263ed4a37f8eb61928013b9cee5d
SHA512fcbd3caeeb2e109cfc0d5fd49cd09f4d8cc0ceb5aa562d91d94f8283f373c31c4a0687c895f4bd142149ac2f63aa97a573d285c4b889aafec261966cbc210648