Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:12
Behavioral task
behavioral1
Sample
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a07483d9515bad319ac179bcda4ee64b
-
SHA1
b506a660a44b2f60b1ff01c642c7b9ea4190dacb
-
SHA256
51807b46de056d542cb4e09a29e386fc98e457f2e78afb69d2f9f2e851d234c7
-
SHA512
3005788a58863a5b4cf94cf70d57994be9a7910289c072b4fef24cf97a4ada4574f39eddba2def5163266c12f75b732a67e5d17a25af2d1b4de718257c7142c2
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwg
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 4616 explorer.exe 4984 explorer.exe 4936 spoolsv.exe 3996 spoolsv.exe 4356 spoolsv.exe 4536 spoolsv.exe 2580 spoolsv.exe 4036 spoolsv.exe 3212 spoolsv.exe 2412 spoolsv.exe 4900 spoolsv.exe 3004 spoolsv.exe 2228 spoolsv.exe 4024 spoolsv.exe 1468 spoolsv.exe 1704 spoolsv.exe 1668 spoolsv.exe 2420 spoolsv.exe 3516 spoolsv.exe 2408 spoolsv.exe 4168 spoolsv.exe 4532 spoolsv.exe 2680 spoolsv.exe 3896 spoolsv.exe 2248 spoolsv.exe 2448 spoolsv.exe 3448 spoolsv.exe 2076 spoolsv.exe 2356 spoolsv.exe 932 spoolsv.exe 3788 spoolsv.exe 1824 spoolsv.exe 4828 spoolsv.exe 4064 spoolsv.exe 3488 spoolsv.exe 4040 spoolsv.exe 1560 spoolsv.exe 4032 spoolsv.exe 4336 explorer.exe 4528 spoolsv.exe 4520 spoolsv.exe 1612 spoolsv.exe 4208 spoolsv.exe 4260 spoolsv.exe 60 spoolsv.exe 4084 spoolsv.exe 1784 spoolsv.exe 2752 explorer.exe 4668 spoolsv.exe 4216 spoolsv.exe 2720 spoolsv.exe 2416 spoolsv.exe 4392 spoolsv.exe 2940 spoolsv.exe 4428 spoolsv.exe 1756 spoolsv.exe 4432 explorer.exe 5048 spoolsv.exe 3340 spoolsv.exe 4332 spoolsv.exe 4548 spoolsv.exe 4720 spoolsv.exe 3972 spoolsv.exe 3992 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
Processes:
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 3816 set thread context of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 4616 set thread context of 4984 4616 explorer.exe explorer.exe PID 4936 set thread context of 4032 4936 spoolsv.exe spoolsv.exe PID 3996 set thread context of 4528 3996 spoolsv.exe spoolsv.exe PID 4356 set thread context of 4520 4356 spoolsv.exe spoolsv.exe PID 4536 set thread context of 1612 4536 spoolsv.exe spoolsv.exe PID 2580 set thread context of 4208 2580 spoolsv.exe spoolsv.exe PID 4036 set thread context of 4260 4036 spoolsv.exe spoolsv.exe PID 3212 set thread context of 4084 3212 spoolsv.exe spoolsv.exe PID 2412 set thread context of 1784 2412 spoolsv.exe spoolsv.exe PID 4900 set thread context of 4668 4900 spoolsv.exe spoolsv.exe PID 3004 set thread context of 4216 3004 spoolsv.exe spoolsv.exe PID 2228 set thread context of 2720 2228 spoolsv.exe spoolsv.exe PID 4024 set thread context of 2416 4024 spoolsv.exe spoolsv.exe PID 1468 set thread context of 4392 1468 spoolsv.exe spoolsv.exe PID 1704 set thread context of 4428 1704 spoolsv.exe spoolsv.exe PID 1668 set thread context of 1756 1668 spoolsv.exe spoolsv.exe PID 2420 set thread context of 5048 2420 spoolsv.exe spoolsv.exe PID 3516 set thread context of 3340 3516 spoolsv.exe spoolsv.exe PID 2408 set thread context of 4332 2408 spoolsv.exe spoolsv.exe PID 4168 set thread context of 4720 4168 spoolsv.exe spoolsv.exe PID 4532 set thread context of 3972 4532 spoolsv.exe spoolsv.exe PID 2680 set thread context of 2700 2680 spoolsv.exe spoolsv.exe PID 3896 set thread context of 3000 3896 spoolsv.exe spoolsv.exe PID 2248 set thread context of 4700 2248 spoolsv.exe spoolsv.exe PID 2448 set thread context of 3444 2448 spoolsv.exe spoolsv.exe PID 3448 set thread context of 2560 3448 spoolsv.exe spoolsv.exe PID 2076 set thread context of 500 2076 spoolsv.exe spoolsv.exe PID 2356 set thread context of 2836 2356 spoolsv.exe spoolsv.exe PID 932 set thread context of 4616 932 spoolsv.exe spoolsv.exe PID 3788 set thread context of 2476 3788 spoolsv.exe spoolsv.exe PID 1824 set thread context of 3360 1824 spoolsv.exe spoolsv.exe PID 4828 set thread context of 3316 4828 spoolsv.exe spoolsv.exe PID 4064 set thread context of 3704 4064 spoolsv.exe spoolsv.exe PID 3488 set thread context of 4632 3488 spoolsv.exe spoolsv.exe PID 4040 set thread context of 2792 4040 spoolsv.exe spoolsv.exe PID 1560 set thread context of 2944 1560 spoolsv.exe spoolsv.exe PID 4336 set thread context of 4708 4336 explorer.exe explorer.exe PID 60 set thread context of 560 60 spoolsv.exe spoolsv.exe PID 2752 set thread context of 2976 2752 explorer.exe explorer.exe PID 2940 set thread context of 1792 2940 spoolsv.exe spoolsv.exe PID 4432 set thread context of 1488 4432 explorer.exe explorer.exe PID 4548 set thread context of 1800 4548 spoolsv.exe spoolsv.exe PID 3992 set thread context of 4056 3992 explorer.exe explorer.exe PID 1840 set thread context of 1744 1840 spoolsv.exe spoolsv.exe PID 2676 set thread context of 1804 2676 explorer.exe explorer.exe PID 4116 set thread context of 1584 4116 spoolsv.exe spoolsv.exe PID 1192 set thread context of 1096 1192 explorer.exe explorer.exe PID 5004 set thread context of 4800 5004 spoolsv.exe spoolsv.exe PID 656 set thread context of 4152 656 explorer.exe explorer.exe PID 4540 set thread context of 2308 4540 spoolsv.exe spoolsv.exe PID 4780 set thread context of 216 4780 spoolsv.exe spoolsv.exe PID 3868 set thread context of 4440 3868 spoolsv.exe spoolsv.exe PID 800 set thread context of 1208 800 spoolsv.exe spoolsv.exe PID 3480 set thread context of 2004 3480 explorer.exe explorer.exe PID 4768 set thread context of 1708 4768 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exeexplorer.exepid process 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4984 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4984 explorer.exe 4032 spoolsv.exe 4032 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 4520 spoolsv.exe 4520 spoolsv.exe 1612 spoolsv.exe 1612 spoolsv.exe 4208 spoolsv.exe 4208 spoolsv.exe 4260 spoolsv.exe 4260 spoolsv.exe 4084 spoolsv.exe 4084 spoolsv.exe 1784 spoolsv.exe 1784 spoolsv.exe 4668 spoolsv.exe 4668 spoolsv.exe 4216 spoolsv.exe 4216 spoolsv.exe 2720 spoolsv.exe 2720 spoolsv.exe 2416 spoolsv.exe 2416 spoolsv.exe 4392 spoolsv.exe 4392 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 1756 spoolsv.exe 1756 spoolsv.exe 5048 spoolsv.exe 5048 spoolsv.exe 3340 spoolsv.exe 3340 spoolsv.exe 4332 spoolsv.exe 4332 spoolsv.exe 4720 spoolsv.exe 4720 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 2700 spoolsv.exe 2700 spoolsv.exe 3000 spoolsv.exe 3000 spoolsv.exe 4700 spoolsv.exe 4700 spoolsv.exe 3444 spoolsv.exe 3444 spoolsv.exe 2560 spoolsv.exe 2560 spoolsv.exe 500 spoolsv.exe 500 spoolsv.exe 2836 spoolsv.exe 2836 spoolsv.exe 4616 spoolsv.exe 4616 spoolsv.exe 2476 spoolsv.exe 2476 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exea07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3816 wrote to memory of 4200 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe splwow64.exe PID 3816 wrote to memory of 4200 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe splwow64.exe PID 3816 wrote to memory of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 3816 wrote to memory of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 3816 wrote to memory of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 3816 wrote to memory of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 3816 wrote to memory of 1568 3816 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe PID 1568 wrote to memory of 4616 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe explorer.exe PID 1568 wrote to memory of 4616 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe explorer.exe PID 1568 wrote to memory of 4616 1568 a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe explorer.exe PID 4616 wrote to memory of 4984 4616 explorer.exe explorer.exe PID 4616 wrote to memory of 4984 4616 explorer.exe explorer.exe PID 4616 wrote to memory of 4984 4616 explorer.exe explorer.exe PID 4616 wrote to memory of 4984 4616 explorer.exe explorer.exe PID 4616 wrote to memory of 4984 4616 explorer.exe explorer.exe PID 4984 wrote to memory of 4936 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4936 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4936 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3996 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3996 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3996 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4356 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4356 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4356 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4536 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4536 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4536 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2580 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2580 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2580 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4036 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4036 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4036 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3212 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3212 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3212 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2412 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2412 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2412 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4900 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4900 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4900 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3004 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3004 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3004 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2228 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2228 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2228 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4024 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4024 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 4024 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1468 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1468 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1468 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1704 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1704 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1704 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1668 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1668 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 1668 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2420 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2420 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 2420 4984 explorer.exe spoolsv.exe PID 4984 wrote to memory of 3516 4984 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a07483d9515bad319ac179bcda4ee64b_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4032 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4336 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4260 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2752 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4668 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1756 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4432 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1488
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3340 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3972 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3992 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3444 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1804
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2476 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1192 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1096
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4632
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:656 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4152
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2944
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3480 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:560
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4892
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1792
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1800
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1744
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1584
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4800
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2308
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:216
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4440
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1708
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1556
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3420
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4916
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2360
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1408
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5084 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2840
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:116 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5f687e72d9afb6fcddf22c088dda95901
SHA1d82a135786361a3b99d5d9e790a407ed0660cf6e
SHA256de2cf2565f99328c97bd49ae851c07175ed93ac30d0e890cddb5a2101c9bf40c
SHA5129c7ae6d9525acfd93f35a4ff386862c86215afefdb322b6213337b2d48b9cf6cdc138e4dd7a4aa6756a457c15d108e02e1b0ed83105267a9ce459a3eb23cea6c
-
Filesize
2.2MB
MD517ad1b8f8f6d84ed15ed05bf4ed65b23
SHA1bd5bb59092258f7a755fe819de4573f722cd1313
SHA256245e074adcf06cb6bf03b29ed28da17f3a5a7b6a492ff3b9cbee5fa67f3869c1
SHA512a7c33f4fafeeb127c182ef9e4b5c4f12c35a2f155205b40b47fcefe8a202559d05ad857c83a6d60f2c58f3d13761c4f829dfc30a5c2e286cc09a01b173131d9d