Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 11:39
Behavioral task
behavioral1
Sample
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a08a2c31a573531e963657095c29b2b3
-
SHA1
569ead5847da2a1b7ef1b1602df45fff7ffcebf4
-
SHA256
44b1a075ce9aede96cb954eabef21f203a61153f3e12d05957ba3354bf891d5c
-
SHA512
41d95ffbf9df8174aa3133954fc2fa240a451aaf884aeff33e64b5d21168d98d4b82969ca799af65e357dfaa9d508284f1f28d8ded7b084eef603f7f4ecfbb2b
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZG:0UzeyQMS4DqodCnoe+iitjWwwa
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3224 explorer.exe 4792 explorer.exe 232 spoolsv.exe 4256 spoolsv.exe 4216 spoolsv.exe 4888 spoolsv.exe 4424 spoolsv.exe 3932 spoolsv.exe 2372 spoolsv.exe 1776 spoolsv.exe 3724 spoolsv.exe 1416 spoolsv.exe 1112 spoolsv.exe 3824 spoolsv.exe 1484 spoolsv.exe 648 spoolsv.exe 4432 spoolsv.exe 2028 spoolsv.exe 1848 spoolsv.exe 2656 spoolsv.exe 516 spoolsv.exe 1104 spoolsv.exe 2708 spoolsv.exe 1268 spoolsv.exe 4352 spoolsv.exe 1864 spoolsv.exe 4420 spoolsv.exe 3532 spoolsv.exe 1216 spoolsv.exe 4076 spoolsv.exe 2692 spoolsv.exe 3528 spoolsv.exe 4260 spoolsv.exe 5088 explorer.exe 4396 spoolsv.exe 3488 spoolsv.exe 4548 spoolsv.exe 4996 spoolsv.exe 5028 explorer.exe 2136 spoolsv.exe 5092 spoolsv.exe 640 spoolsv.exe 996 spoolsv.exe 4456 spoolsv.exe 4428 spoolsv.exe 3948 spoolsv.exe 1696 explorer.exe 1308 spoolsv.exe 2668 spoolsv.exe 3988 spoolsv.exe 3940 spoolsv.exe 1224 spoolsv.exe 2536 explorer.exe 4672 spoolsv.exe 3408 spoolsv.exe 2556 spoolsv.exe 2200 spoolsv.exe 888 spoolsv.exe 2596 spoolsv.exe 2712 explorer.exe 4264 spoolsv.exe 4008 spoolsv.exe 1192 spoolsv.exe 1660 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 4992 set thread context of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 3224 set thread context of 4792 3224 explorer.exe explorer.exe PID 232 set thread context of 4260 232 spoolsv.exe spoolsv.exe PID 4256 set thread context of 4396 4256 spoolsv.exe spoolsv.exe PID 4216 set thread context of 3488 4216 spoolsv.exe spoolsv.exe PID 4888 set thread context of 4548 4888 spoolsv.exe spoolsv.exe PID 4424 set thread context of 4996 4424 spoolsv.exe spoolsv.exe PID 3932 set thread context of 2136 3932 spoolsv.exe spoolsv.exe PID 2372 set thread context of 640 2372 spoolsv.exe spoolsv.exe PID 1776 set thread context of 996 1776 spoolsv.exe spoolsv.exe PID 3724 set thread context of 4456 3724 spoolsv.exe spoolsv.exe PID 1416 set thread context of 3948 1416 spoolsv.exe spoolsv.exe PID 1112 set thread context of 1308 1112 spoolsv.exe spoolsv.exe PID 3824 set thread context of 2668 3824 spoolsv.exe spoolsv.exe PID 1484 set thread context of 3988 1484 spoolsv.exe spoolsv.exe PID 648 set thread context of 1224 648 spoolsv.exe spoolsv.exe PID 4432 set thread context of 4672 4432 spoolsv.exe spoolsv.exe PID 2028 set thread context of 3408 2028 spoolsv.exe spoolsv.exe PID 1848 set thread context of 2556 1848 spoolsv.exe spoolsv.exe PID 2656 set thread context of 2200 2656 spoolsv.exe spoolsv.exe PID 516 set thread context of 2596 516 spoolsv.exe spoolsv.exe PID 1104 set thread context of 4264 1104 spoolsv.exe spoolsv.exe PID 2708 set thread context of 4008 2708 spoolsv.exe spoolsv.exe PID 1268 set thread context of 1660 1268 spoolsv.exe spoolsv.exe PID 4352 set thread context of 968 4352 spoolsv.exe spoolsv.exe PID 1864 set thread context of 2268 1864 spoolsv.exe spoolsv.exe PID 4420 set thread context of 4768 4420 spoolsv.exe spoolsv.exe PID 3532 set thread context of 2424 3532 spoolsv.exe spoolsv.exe PID 1216 set thread context of 4336 1216 spoolsv.exe spoolsv.exe PID 4076 set thread context of 3564 4076 spoolsv.exe spoolsv.exe PID 2692 set thread context of 3176 2692 spoolsv.exe spoolsv.exe PID 5088 set thread context of 3592 5088 explorer.exe explorer.exe PID 3528 set thread context of 1480 3528 spoolsv.exe spoolsv.exe PID 5028 set thread context of 1884 5028 explorer.exe explorer.exe PID 5092 set thread context of 3848 5092 spoolsv.exe spoolsv.exe PID 4428 set thread context of 1364 4428 spoolsv.exe spoolsv.exe PID 1696 set thread context of 4476 1696 explorer.exe explorer.exe PID 2536 set thread context of 2964 2536 explorer.exe explorer.exe PID 3940 set thread context of 5112 3940 spoolsv.exe spoolsv.exe PID 888 set thread context of 2172 888 spoolsv.exe spoolsv.exe PID 2712 set thread context of 3192 2712 explorer.exe explorer.exe PID 1192 set thread context of 748 1192 spoolsv.exe spoolsv.exe PID 2336 set thread context of 3124 2336 explorer.exe explorer.exe PID 4540 set thread context of 4480 4540 spoolsv.exe spoolsv.exe PID 1252 set thread context of 3452 1252 explorer.exe explorer.exe PID 3972 set thread context of 4200 3972 spoolsv.exe spoolsv.exe PID 4560 set thread context of 2300 4560 explorer.exe explorer.exe PID 3920 set thread context of 952 3920 spoolsv.exe spoolsv.exe PID 336 set thread context of 1676 336 spoolsv.exe spoolsv.exe PID 3208 set thread context of 2188 3208 spoolsv.exe spoolsv.exe PID 1288 set thread context of 3268 1288 spoolsv.exe spoolsv.exe PID 4532 set thread context of 3636 4532 explorer.exe explorer.exe PID 532 set thread context of 4088 532 spoolsv.exe spoolsv.exe PID 1664 set thread context of 1624 1664 spoolsv.exe spoolsv.exe PID 2032 set thread context of 3572 2032 explorer.exe explorer.exe PID 3644 set thread context of 228 3644 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exea08a2c31a573531e963657095c29b2b3_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exeexplorer.exepid process 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4792 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4792 explorer.exe 4260 spoolsv.exe 4260 spoolsv.exe 4396 spoolsv.exe 4396 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe 4548 spoolsv.exe 4548 spoolsv.exe 4996 spoolsv.exe 4996 spoolsv.exe 2136 spoolsv.exe 2136 spoolsv.exe 640 spoolsv.exe 640 spoolsv.exe 996 spoolsv.exe 996 spoolsv.exe 4456 spoolsv.exe 4456 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe 1308 spoolsv.exe 1308 spoolsv.exe 2668 spoolsv.exe 2668 spoolsv.exe 3988 spoolsv.exe 3988 spoolsv.exe 1224 spoolsv.exe 1224 spoolsv.exe 4672 spoolsv.exe 4672 spoolsv.exe 3408 spoolsv.exe 3408 spoolsv.exe 2556 spoolsv.exe 2556 spoolsv.exe 2200 spoolsv.exe 2200 spoolsv.exe 2596 spoolsv.exe 2596 spoolsv.exe 4264 spoolsv.exe 4264 spoolsv.exe 4008 spoolsv.exe 4008 spoolsv.exe 1660 spoolsv.exe 1660 spoolsv.exe 968 spoolsv.exe 968 spoolsv.exe 2268 spoolsv.exe 2268 spoolsv.exe 4768 spoolsv.exe 4768 spoolsv.exe 2424 spoolsv.exe 2424 spoolsv.exe 4336 spoolsv.exe 4336 spoolsv.exe 3564 spoolsv.exe 3564 spoolsv.exe 3176 spoolsv.exe 3176 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exea08a2c31a573531e963657095c29b2b3_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4992 wrote to memory of 2888 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe splwow64.exe PID 4992 wrote to memory of 2888 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe splwow64.exe PID 4992 wrote to memory of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 4992 wrote to memory of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 4992 wrote to memory of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 4992 wrote to memory of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 4992 wrote to memory of 3116 4992 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe PID 3116 wrote to memory of 3224 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe explorer.exe PID 3116 wrote to memory of 3224 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe explorer.exe PID 3116 wrote to memory of 3224 3116 a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe explorer.exe PID 3224 wrote to memory of 4792 3224 explorer.exe explorer.exe PID 3224 wrote to memory of 4792 3224 explorer.exe explorer.exe PID 3224 wrote to memory of 4792 3224 explorer.exe explorer.exe PID 3224 wrote to memory of 4792 3224 explorer.exe explorer.exe PID 3224 wrote to memory of 4792 3224 explorer.exe explorer.exe PID 4792 wrote to memory of 232 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 232 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 232 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4256 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4256 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4256 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4216 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4216 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4216 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4888 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4888 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4888 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4424 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4424 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4424 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3932 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3932 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3932 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2372 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2372 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2372 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1776 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1776 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1776 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3724 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3724 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3724 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1416 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1416 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1416 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1112 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1112 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1112 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3824 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3824 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 3824 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1484 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1484 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1484 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 648 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 648 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 648 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4432 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4432 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 4432 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2028 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2028 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 2028 4792 explorer.exe spoolsv.exe PID 4792 wrote to memory of 1848 4792 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a08a2c31a573531e963657095c29b2b3_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4260 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5088 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4996 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5028 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3948 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1696 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2668 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2536 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4672 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2712 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:968 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2336 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2268 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2424 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1252 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4336 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3176 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4560 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1480
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3636
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3848
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2032 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3572
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1364
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2172
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4104 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:748
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4480
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:948 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:952
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1676
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2188
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1624
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:628 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5084
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
2.2MB
MD554cffa84079e6ec01ba789389ed98123
SHA159bbc4f142f65fb76e625dc7e561a1ca63f98638
SHA2567d24b8582f79535531366733c4492707d430b919fcf4d2f512761c694e66d97f
SHA5128fc093e7ea628dd6dd4f4f63ea0612b6d2bae01b66d0c307af25b149f9f66e342c5e1959195683469405c9f1263ff6c2094bb7c51978f196ff8bdba2088a0960
-
Filesize
2.2MB
MD584a8177330cf8d025e2afc8d40e1cd92
SHA15ba3315702a1888d5b29da98c159eca4cb938c6b
SHA2561b5d886bddb916d6536ac1ceb8c67ed8c35a1e4513635c8464f53fc89b09353d
SHA51269f15469a6a8667008cc2aa341a76dd3f181782ddc0a6196254a85cd6daf4f672bef7b116530ea5ead6318fbf58b1f6460d74247149218004b63cc3bf73808be