Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:33
Behavioral task
behavioral1
Sample
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0855f3315bbfc1f4e03caf1d1b4ebea
-
SHA1
7f2c6ad89320b1c62c9de128ab123125714ffa7b
-
SHA256
f243b6e399913e34f716107b490faa35a6075fad791c7d25126c91bb67b4470f
-
SHA512
8e39d5ddc7c424971213ba6037c4ec0e434553146b673767fc4b8b6b0f5aae39a9e03a4e513c823a25249ae3e97b86f4c9fb4c7e98805f47af3fb8f73803cc9d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwg
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 8 explorer.exe 4580 explorer.exe 4424 spoolsv.exe 3096 spoolsv.exe 2684 spoolsv.exe 764 spoolsv.exe 908 spoolsv.exe 1796 spoolsv.exe 1700 spoolsv.exe 1064 spoolsv.exe 3236 spoolsv.exe 1432 spoolsv.exe 1400 spoolsv.exe 644 spoolsv.exe 640 spoolsv.exe 1532 spoolsv.exe 2816 spoolsv.exe 3468 spoolsv.exe 404 spoolsv.exe 8 spoolsv.exe 4816 spoolsv.exe 4784 spoolsv.exe 3388 spoolsv.exe 2596 spoolsv.exe 2276 spoolsv.exe 4192 spoolsv.exe 4892 spoolsv.exe 3928 spoolsv.exe 4984 spoolsv.exe 3332 spoolsv.exe 2028 spoolsv.exe 2060 spoolsv.exe 4576 spoolsv.exe 3264 spoolsv.exe 3180 explorer.exe 952 spoolsv.exe 4400 spoolsv.exe 3740 spoolsv.exe 5044 spoolsv.exe 3108 spoolsv.exe 1812 spoolsv.exe 4448 spoolsv.exe 1896 spoolsv.exe 212 spoolsv.exe 2196 explorer.exe 3964 spoolsv.exe 3284 spoolsv.exe 3224 spoolsv.exe 4080 spoolsv.exe 1728 spoolsv.exe 3272 spoolsv.exe 4396 explorer.exe 3668 spoolsv.exe 884 spoolsv.exe 3316 spoolsv.exe 2236 spoolsv.exe 2160 spoolsv.exe 4536 spoolsv.exe 3016 explorer.exe 4712 spoolsv.exe 4404 spoolsv.exe 2616 spoolsv.exe 3212 spoolsv.exe 1528 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
Processes:
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 4112 set thread context of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 8 set thread context of 4580 8 explorer.exe explorer.exe PID 4424 set thread context of 3264 4424 spoolsv.exe spoolsv.exe PID 3096 set thread context of 952 3096 spoolsv.exe spoolsv.exe PID 2684 set thread context of 4400 2684 spoolsv.exe spoolsv.exe PID 764 set thread context of 5044 764 spoolsv.exe spoolsv.exe PID 908 set thread context of 3108 908 spoolsv.exe spoolsv.exe PID 1796 set thread context of 1812 1796 spoolsv.exe spoolsv.exe PID 1700 set thread context of 4448 1700 spoolsv.exe spoolsv.exe PID 1064 set thread context of 212 1064 spoolsv.exe spoolsv.exe PID 3236 set thread context of 3964 3236 spoolsv.exe spoolsv.exe PID 1432 set thread context of 3284 1432 spoolsv.exe spoolsv.exe PID 1400 set thread context of 3224 1400 spoolsv.exe spoolsv.exe PID 644 set thread context of 4080 644 spoolsv.exe spoolsv.exe PID 640 set thread context of 3272 640 spoolsv.exe spoolsv.exe PID 1532 set thread context of 3668 1532 spoolsv.exe spoolsv.exe PID 2816 set thread context of 884 2816 spoolsv.exe spoolsv.exe PID 3468 set thread context of 3316 3468 spoolsv.exe spoolsv.exe PID 404 set thread context of 2236 404 spoolsv.exe spoolsv.exe PID 8 set thread context of 4536 8 spoolsv.exe spoolsv.exe PID 4816 set thread context of 4712 4816 spoolsv.exe spoolsv.exe PID 4784 set thread context of 4404 4784 spoolsv.exe spoolsv.exe PID 3388 set thread context of 3212 3388 spoolsv.exe spoolsv.exe PID 2596 set thread context of 4760 2596 spoolsv.exe spoolsv.exe PID 2276 set thread context of 1148 2276 spoolsv.exe spoolsv.exe PID 4192 set thread context of 4452 4192 spoolsv.exe spoolsv.exe PID 4892 set thread context of 4036 4892 spoolsv.exe spoolsv.exe PID 3928 set thread context of 3372 3928 spoolsv.exe spoolsv.exe PID 4984 set thread context of 4768 4984 spoolsv.exe spoolsv.exe PID 3332 set thread context of 728 3332 spoolsv.exe spoolsv.exe PID 2028 set thread context of 5088 2028 spoolsv.exe spoolsv.exe PID 2060 set thread context of 2568 2060 spoolsv.exe spoolsv.exe PID 4576 set thread context of 5092 4576 spoolsv.exe spoolsv.exe PID 3180 set thread context of 3988 3180 explorer.exe explorer.exe PID 3740 set thread context of 2256 3740 spoolsv.exe spoolsv.exe PID 1896 set thread context of 3104 1896 spoolsv.exe spoolsv.exe PID 2196 set thread context of 3960 2196 explorer.exe explorer.exe PID 1728 set thread context of 1476 1728 spoolsv.exe spoolsv.exe PID 4396 set thread context of 1836 4396 explorer.exe explorer.exe PID 2160 set thread context of 3968 2160 spoolsv.exe spoolsv.exe PID 3016 set thread context of 5000 3016 explorer.exe explorer.exe PID 2616 set thread context of 1268 2616 spoolsv.exe spoolsv.exe PID 1528 set thread context of 1336 1528 explorer.exe explorer.exe PID 2168 set thread context of 3580 2168 spoolsv.exe spoolsv.exe PID 1888 set thread context of 1452 1888 explorer.exe explorer.exe PID 916 set thread context of 1972 916 spoolsv.exe spoolsv.exe PID 4512 set thread context of 368 4512 explorer.exe explorer.exe PID 1328 set thread context of 3256 1328 spoolsv.exe spoolsv.exe PID 3592 set thread context of 232 3592 spoolsv.exe spoolsv.exe PID 1876 set thread context of 4076 1876 spoolsv.exe spoolsv.exe PID 3296 set thread context of 4508 3296 explorer.exe explorer.exe PID 4060 set thread context of 1912 4060 spoolsv.exe spoolsv.exe PID 1928 set thread context of 1180 1928 spoolsv.exe spoolsv.exe PID 3588 set thread context of 1820 3588 explorer.exe explorer.exe PID 2980 set thread context of 448 2980 spoolsv.exe spoolsv.exe PID 4056 set thread context of 2040 4056 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exea0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exeexplorer.exepid process 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4580 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 4580 explorer.exe 3264 spoolsv.exe 3264 spoolsv.exe 952 spoolsv.exe 952 spoolsv.exe 4400 spoolsv.exe 4400 spoolsv.exe 5044 spoolsv.exe 5044 spoolsv.exe 3108 spoolsv.exe 3108 spoolsv.exe 1812 spoolsv.exe 1812 spoolsv.exe 4448 spoolsv.exe 4448 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 3964 spoolsv.exe 3964 spoolsv.exe 3284 spoolsv.exe 3284 spoolsv.exe 3224 spoolsv.exe 3224 spoolsv.exe 4080 spoolsv.exe 4080 spoolsv.exe 3272 spoolsv.exe 3272 spoolsv.exe 3668 spoolsv.exe 3668 spoolsv.exe 884 spoolsv.exe 884 spoolsv.exe 3316 spoolsv.exe 3316 spoolsv.exe 2236 spoolsv.exe 2236 spoolsv.exe 4536 spoolsv.exe 4536 spoolsv.exe 4712 spoolsv.exe 4712 spoolsv.exe 4404 spoolsv.exe 4404 spoolsv.exe 3212 spoolsv.exe 3212 spoolsv.exe 4760 spoolsv.exe 4760 spoolsv.exe 1148 spoolsv.exe 1148 spoolsv.exe 4452 spoolsv.exe 4452 spoolsv.exe 4036 spoolsv.exe 4036 spoolsv.exe 3372 spoolsv.exe 3372 spoolsv.exe 4768 spoolsv.exe 4768 spoolsv.exe 728 spoolsv.exe 728 spoolsv.exe 5088 spoolsv.exe 5088 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exea0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4112 wrote to memory of 320 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe splwow64.exe PID 4112 wrote to memory of 320 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe splwow64.exe PID 4112 wrote to memory of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 4112 wrote to memory of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 4112 wrote to memory of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 4112 wrote to memory of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 4112 wrote to memory of 4160 4112 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe PID 4160 wrote to memory of 8 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe explorer.exe PID 4160 wrote to memory of 8 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe explorer.exe PID 4160 wrote to memory of 8 4160 a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe explorer.exe PID 8 wrote to memory of 4580 8 explorer.exe explorer.exe PID 8 wrote to memory of 4580 8 explorer.exe explorer.exe PID 8 wrote to memory of 4580 8 explorer.exe explorer.exe PID 8 wrote to memory of 4580 8 explorer.exe explorer.exe PID 8 wrote to memory of 4580 8 explorer.exe explorer.exe PID 4580 wrote to memory of 4424 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 4424 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 4424 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3096 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3096 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3096 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2684 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2684 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2684 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 764 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 764 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 764 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 908 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 908 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 908 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1796 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1796 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1796 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1700 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1700 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1700 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1064 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1064 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1064 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3236 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3236 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3236 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1432 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1432 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1432 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1400 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1400 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1400 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 644 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 644 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 644 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 640 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 640 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 640 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1532 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1532 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 1532 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2816 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2816 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 2816 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3468 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3468 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3468 4580 explorer.exe spoolsv.exe PID 4580 wrote to memory of 404 4580 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0855f3315bbfc1f4e03caf1d1b4ebea_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3180 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4400 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3108 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:212 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2196 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3272 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4396 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3668 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:8 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4536 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3016 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3212 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1528 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4036 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1888 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2568
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4512 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5092
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3296 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4508
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2256
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3588 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3104
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4568 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1476
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2100 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3968
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3680 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1268
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:700 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3580
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4076
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1180
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2592
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2576
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1072 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2528 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1580 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3232
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5096
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52fbce0bc3a396046e3477cadb079e948
SHA151484977916146faed7b079b1776e9cf09e24efd
SHA256a3f7e5fadf9acc40bc579b72d625925ceed9c37eda0effba4fb6340c07970604
SHA512e107642a740f7959e90b8ef2bc5faafd9b052b0bfa57078ae9d728ffff902dc706c1a4f1a2fb11957b0d48f5981f31b3aac5c3e7096d8e7d86867600217c1fe4
-
Filesize
2.2MB
MD51764d3147dcf359cc3aa559a0e1b00d7
SHA1ec664a3d78b6d43d3c6f26fafddfd01c3eab0e8a
SHA256ba286047d90ed3507fac7937bcd23a79f475a78f5f101e20a6e31a205642b987
SHA512494c75b55b16080594ada24e4923acb496702869f49f85dafe65b15d0849f463fef20df9c4ef0073c900bee0a7162b1f27a15b6f7880c58a862c7ae9547b66e3