Analysis
-
max time kernel
148s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 12:01
Behavioral task
behavioral1
Sample
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a098b0f2b44b0cf9d1bb8828bc6d56cf
-
SHA1
62167982a8ff1a8605754cccb5b73ce0e875e311
-
SHA256
a33fa237203617c0a450baec3ee86393b33a8f64d6ee183ccda28509e239f6f9
-
SHA512
e0fbeb5eb3713695e4c397a3b864b782b7fbaa430c0bec890b183804eb078fa62a2939bc5c90cf7e4f25d8ea0dfba7f6ee081a674803598e955357844b77ca43
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwww
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 3108 explorer.exe 3444 explorer.exe 1640 spoolsv.exe 2352 spoolsv.exe 4608 spoolsv.exe 4576 spoolsv.exe 1828 spoolsv.exe 2288 spoolsv.exe 1344 spoolsv.exe 2956 spoolsv.exe 4044 spoolsv.exe 3508 spoolsv.exe 4392 spoolsv.exe 3976 spoolsv.exe 3972 spoolsv.exe 4600 spoolsv.exe 2484 spoolsv.exe 3140 spoolsv.exe 3304 spoolsv.exe 1984 spoolsv.exe 3808 spoolsv.exe 2756 spoolsv.exe 548 spoolsv.exe 3036 spoolsv.exe 4452 spoolsv.exe 1816 spoolsv.exe 3108 spoolsv.exe 3436 spoolsv.exe 2148 spoolsv.exe 3888 spoolsv.exe 2068 spoolsv.exe 1856 spoolsv.exe 4192 spoolsv.exe 1648 explorer.exe 1260 spoolsv.exe 2360 spoolsv.exe 4796 spoolsv.exe 388 spoolsv.exe 4564 spoolsv.exe 2996 spoolsv.exe 2652 spoolsv.exe 2320 spoolsv.exe 4976 explorer.exe 920 spoolsv.exe 1860 spoolsv.exe 4420 spoolsv.exe 1476 spoolsv.exe 2112 spoolsv.exe 4844 spoolsv.exe 3112 spoolsv.exe 1436 explorer.exe 4196 spoolsv.exe 2332 spoolsv.exe 1080 spoolsv.exe 1152 spoolsv.exe 4048 explorer.exe 3948 spoolsv.exe 1692 spoolsv.exe 2960 spoolsv.exe 3156 spoolsv.exe 2716 spoolsv.exe 2344 spoolsv.exe 5052 explorer.exe 4092 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
Processes:
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 3156 set thread context of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 3108 set thread context of 3444 3108 explorer.exe explorer.exe PID 1640 set thread context of 4192 1640 spoolsv.exe spoolsv.exe PID 2352 set thread context of 1260 2352 spoolsv.exe spoolsv.exe PID 4608 set thread context of 2360 4608 spoolsv.exe spoolsv.exe PID 4576 set thread context of 4796 4576 spoolsv.exe spoolsv.exe PID 1828 set thread context of 4564 1828 spoolsv.exe spoolsv.exe PID 2288 set thread context of 2996 2288 spoolsv.exe spoolsv.exe PID 1344 set thread context of 2652 1344 spoolsv.exe spoolsv.exe PID 2956 set thread context of 2320 2956 spoolsv.exe spoolsv.exe PID 4044 set thread context of 920 4044 spoolsv.exe spoolsv.exe PID 3508 set thread context of 4420 3508 spoolsv.exe spoolsv.exe PID 4392 set thread context of 1476 4392 spoolsv.exe spoolsv.exe PID 3976 set thread context of 2112 3976 spoolsv.exe spoolsv.exe PID 3972 set thread context of 4844 3972 spoolsv.exe spoolsv.exe PID 4600 set thread context of 3112 4600 spoolsv.exe spoolsv.exe PID 2484 set thread context of 2332 2484 spoolsv.exe spoolsv.exe PID 3140 set thread context of 1080 3140 spoolsv.exe spoolsv.exe PID 3304 set thread context of 1152 3304 spoolsv.exe spoolsv.exe PID 1984 set thread context of 1692 1984 spoolsv.exe spoolsv.exe PID 3808 set thread context of 2960 3808 spoolsv.exe spoolsv.exe PID 2756 set thread context of 3156 2756 spoolsv.exe spoolsv.exe PID 548 set thread context of 2716 548 spoolsv.exe spoolsv.exe PID 3036 set thread context of 2344 3036 spoolsv.exe spoolsv.exe PID 4452 set thread context of 4280 4452 spoolsv.exe spoolsv.exe PID 1816 set thread context of 3968 1816 spoolsv.exe spoolsv.exe PID 3108 set thread context of 1740 3108 spoolsv.exe spoolsv.exe PID 3436 set thread context of 5092 3436 spoolsv.exe spoolsv.exe PID 2148 set thread context of 2636 2148 spoolsv.exe spoolsv.exe PID 3888 set thread context of 4060 3888 spoolsv.exe spoolsv.exe PID 2068 set thread context of 3536 2068 spoolsv.exe spoolsv.exe PID 1856 set thread context of 4340 1856 spoolsv.exe spoolsv.exe PID 1648 set thread context of 4448 1648 explorer.exe explorer.exe PID 388 set thread context of 2460 388 spoolsv.exe spoolsv.exe PID 4976 set thread context of 2772 4976 explorer.exe explorer.exe PID 1860 set thread context of 3320 1860 spoolsv.exe spoolsv.exe PID 1436 set thread context of 2740 1436 explorer.exe explorer.exe PID 4196 set thread context of 2800 4196 spoolsv.exe spoolsv.exe PID 4048 set thread context of 3944 4048 explorer.exe explorer.exe PID 3948 set thread context of 2528 3948 spoolsv.exe spoolsv.exe PID 4092 set thread context of 384 4092 spoolsv.exe spoolsv.exe PID 5052 set thread context of 3200 5052 explorer.exe explorer.exe PID 3428 set thread context of 2300 3428 spoolsv.exe spoolsv.exe PID 4320 set thread context of 4800 4320 explorer.exe explorer.exe PID 1108 set thread context of 3804 1108 spoolsv.exe spoolsv.exe PID 3892 set thread context of 1012 3892 spoolsv.exe spoolsv.exe PID 1776 set thread context of 940 1776 spoolsv.exe spoolsv.exe PID 1920 set thread context of 4820 1920 spoolsv.exe spoolsv.exe PID 2304 set thread context of 4172 2304 explorer.exe explorer.exe PID 1824 set thread context of 4836 1824 spoolsv.exe spoolsv.exe PID 456 set thread context of 864 456 spoolsv.exe spoolsv.exe PID 4720 set thread context of 3448 4720 spoolsv.exe spoolsv.exe PID 3644 set thread context of 4468 3644 spoolsv.exe spoolsv.exe PID 1412 set thread context of 1100 1412 explorer.exe explorer.exe PID 4436 set thread context of 4860 4436 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exea098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exeexplorer.exepid process 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3444 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 3444 explorer.exe 4192 spoolsv.exe 4192 spoolsv.exe 1260 spoolsv.exe 1260 spoolsv.exe 2360 spoolsv.exe 2360 spoolsv.exe 4796 spoolsv.exe 4796 spoolsv.exe 4564 spoolsv.exe 4564 spoolsv.exe 2996 spoolsv.exe 2996 spoolsv.exe 2652 spoolsv.exe 2652 spoolsv.exe 2320 spoolsv.exe 2320 spoolsv.exe 920 spoolsv.exe 920 spoolsv.exe 4420 spoolsv.exe 4420 spoolsv.exe 1476 spoolsv.exe 1476 spoolsv.exe 2112 spoolsv.exe 2112 spoolsv.exe 4844 spoolsv.exe 4844 spoolsv.exe 3112 spoolsv.exe 3112 spoolsv.exe 2332 spoolsv.exe 2332 spoolsv.exe 1080 spoolsv.exe 1080 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 1692 spoolsv.exe 1692 spoolsv.exe 2960 spoolsv.exe 2960 spoolsv.exe 3156 spoolsv.exe 3156 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 2344 spoolsv.exe 2344 spoolsv.exe 4280 spoolsv.exe 4280 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 1740 spoolsv.exe 1740 spoolsv.exe 5092 spoolsv.exe 5092 spoolsv.exe 2636 spoolsv.exe 2636 spoolsv.exe 4060 spoolsv.exe 4060 spoolsv.exe 3536 spoolsv.exe 3536 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exea098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3156 wrote to memory of 3364 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe splwow64.exe PID 3156 wrote to memory of 3364 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe splwow64.exe PID 3156 wrote to memory of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 3156 wrote to memory of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 3156 wrote to memory of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 3156 wrote to memory of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 3156 wrote to memory of 2908 3156 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe PID 2908 wrote to memory of 3108 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe explorer.exe PID 2908 wrote to memory of 3108 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe explorer.exe PID 2908 wrote to memory of 3108 2908 a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe explorer.exe PID 3108 wrote to memory of 3444 3108 explorer.exe explorer.exe PID 3108 wrote to memory of 3444 3108 explorer.exe explorer.exe PID 3108 wrote to memory of 3444 3108 explorer.exe explorer.exe PID 3108 wrote to memory of 3444 3108 explorer.exe explorer.exe PID 3108 wrote to memory of 3444 3108 explorer.exe explorer.exe PID 3444 wrote to memory of 1640 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1640 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1640 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2352 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2352 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2352 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4608 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4608 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4608 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4576 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4576 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4576 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1828 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1828 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1828 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2288 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2288 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2288 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1344 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1344 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 1344 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2956 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2956 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2956 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4044 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4044 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4044 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3508 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3508 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3508 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4392 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4392 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4392 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3976 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3976 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3976 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3972 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3972 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3972 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4600 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4600 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 4600 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2484 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2484 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 2484 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3140 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3140 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3140 3444 explorer.exe spoolsv.exe PID 3444 wrote to memory of 3304 3444 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a098b0f2b44b0cf9d1bb8828bc6d56cf_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4976 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4420 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1436 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4048 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5052 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5092 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4320 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4800
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4060 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3536 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4340
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:2304 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4172
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2460
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1412 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3320
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2800
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1384
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2528
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:384
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2300
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3804
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:940
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4836
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4860
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2004
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1684
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD565ec35430101ecfb9118729410e4939e
SHA1dead118c44f4a10c05bbd92c4d9221a15bf04c0b
SHA256009bd09bb7e6448bc8d0510bb880b9eb4ce50dd183c365cc2a4096ae492fbf67
SHA51230a2ddad504c196281a80e056131b8d4d1201b4d68e75d7f3430a6c973b9beb08414f538f5732c5690d7ae2f35bf12676cbaca8c99529b8df1e20c9c3e42f673
-
Filesize
2.2MB
MD55612582fb3eea0a157e5dd40f10f8362
SHA13ce804e8c674c9147217313bc055bc19491fdedb
SHA256902dbef5279b4283ec688870cf4748940606649164ea46fa4b131a54c0adc6fd
SHA51234c0cf42e156be6a6fa6546aff311e437ce38af13163bba28107a10b42ae12fb5eac082c3add141281619ae4cba55046637e90701a498b41aa0ed04a32fbcae8