Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 12:20
Behavioral task
behavioral1
Sample
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0a69944b8356d922396a108113d4f05
-
SHA1
2232246b3b6a8284fe222927cfd62d5486a57ea6
-
SHA256
7a29123f6df6bca1b2c5b72506d40f536a00ac20f92b54fe08b6ec54b0f663fb
-
SHA512
a99566969569c57fa0c58d9295adb2d3515a3128b3870419b7c13fdf6d5ba342ad5b9c9c6d94c16c611b7e1ce7af2b8ea2c400e57678465c3a630575b3c50a9d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe -
Executes dropped EXE 25 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2772 explorer.exe 1828 explorer.exe 4376 explorer.exe 3696 explorer.exe 1424 explorer.exe 1404 explorer.exe 2256 explorer.exe 5112 explorer.exe 5000 explorer.exe 4404 explorer.exe 1644 explorer.exe 4304 explorer.exe 4552 explorer.exe 2376 explorer.exe 3748 explorer.exe 1952 explorer.exe 4936 explorer.exe 1652 explorer.exe 1884 explorer.exe 4592 explorer.exe 4436 explorer.exe 2296 explorer.exe 2576 explorer.exe 4232 explorer.exe 1216 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1620 set thread context of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 2772 set thread context of 1828 2772 explorer.exe explorer.exe PID 4880 set thread context of 2668 4880 spoolsv.exe spoolsv.exe PID 1912 set thread context of 4068 1912 spoolsv.exe spoolsv.exe PID 4648 set thread context of 4796 4648 spoolsv.exe spoolsv.exe PID 724 set thread context of 4884 724 spoolsv.exe spoolsv.exe PID 1036 set thread context of 4456 1036 spoolsv.exe spoolsv.exe PID 2552 set thread context of 3996 2552 spoolsv.exe spoolsv.exe PID 4568 set thread context of 2416 4568 spoolsv.exe spoolsv.exe PID 1620 set thread context of 4288 1620 spoolsv.exe spoolsv.exe PID 1560 set thread context of 4324 1560 spoolsv.exe spoolsv.exe PID 1092 set thread context of 3940 1092 spoolsv.exe spoolsv.exe PID 232 set thread context of 4416 232 spoolsv.exe spoolsv.exe PID 3564 set thread context of 1164 3564 spoolsv.exe spoolsv.exe PID 884 set thread context of 2492 884 spoolsv.exe spoolsv.exe PID 1728 set thread context of 3976 1728 spoolsv.exe spoolsv.exe PID 1836 set thread context of 3124 1836 spoolsv.exe spoolsv.exe PID 1588 set thread context of 3016 1588 spoolsv.exe spoolsv.exe PID 3504 set thread context of 4424 3504 spoolsv.exe spoolsv.exe PID 4844 set thread context of 1708 4844 spoolsv.exe spoolsv.exe PID 1388 set thread context of 1396 1388 spoolsv.exe spoolsv.exe PID 1624 set thread context of 1536 1624 spoolsv.exe spoolsv.exe PID 5104 set thread context of 3220 5104 spoolsv.exe spoolsv.exe PID 4904 set thread context of 3228 4904 spoolsv.exe spoolsv.exe PID 2108 set thread context of 1128 2108 spoolsv.exe spoolsv.exe PID 3612 set thread context of 3188 3612 spoolsv.exe spoolsv.exe PID 4296 set thread context of 3368 4296 spoolsv.exe spoolsv.exe PID 4640 set thread context of 1736 4640 spoolsv.exe spoolsv.exe PID 1632 set thread context of 1044 1632 spoolsv.exe spoolsv.exe PID 1020 set thread context of 4564 1020 spoolsv.exe spoolsv.exe PID 680 set thread context of 2488 680 spoolsv.exe spoolsv.exe PID 3208 set thread context of 4200 3208 spoolsv.exe spoolsv.exe PID 3652 set thread context of 4364 3652 spoolsv.exe spoolsv.exe PID 4376 set thread context of 4404 4376 explorer.exe explorer.exe PID 1272 set thread context of 4732 1272 spoolsv.exe spoolsv.exe PID 3696 set thread context of 4304 3696 explorer.exe explorer.exe PID 4912 set thread context of 1576 4912 spoolsv.exe spoolsv.exe PID 1424 set thread context of 2376 1424 explorer.exe explorer.exe PID 1472 set thread context of 5080 1472 spoolsv.exe spoolsv.exe PID 464 set thread context of 3676 464 spoolsv.exe spoolsv.exe PID 1404 set thread context of 4936 1404 explorer.exe explorer.exe PID 3000 set thread context of 5028 3000 spoolsv.exe spoolsv.exe PID 2256 set thread context of 1884 2256 explorer.exe explorer.exe PID 4380 set thread context of 3780 4380 spoolsv.exe spoolsv.exe PID 5112 set thread context of 4436 5112 explorer.exe explorer.exe PID 324 set thread context of 5040 324 spoolsv.exe spoolsv.exe PID 1856 set thread context of 1820 1856 spoolsv.exe spoolsv.exe PID 5000 set thread context of 2576 5000 explorer.exe explorer.exe PID 2584 set thread context of 3640 2584 spoolsv.exe spoolsv.exe PID 3688 set thread context of 3044 3688 spoolsv.exe spoolsv.exe PID 3040 set thread context of 3872 3040 spoolsv.exe spoolsv.exe PID 4496 set thread context of 1924 4496 spoolsv.exe spoolsv.exe PID 4572 set thread context of 3212 4572 spoolsv.exe spoolsv.exe PID 3596 set thread context of 3452 3596 spoolsv.exe spoolsv.exe PID 2372 set thread context of 1280 2372 spoolsv.exe spoolsv.exe PID 1644 set thread context of 1216 1644 explorer.exe explorer.exe PID 3908 set thread context of 2000 3908 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exea0a69944b8356d922396a108113d4f05_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea0a69944b8356d922396a108113d4f05_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exepid process 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe 2668 spoolsv.exe 2668 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 4796 spoolsv.exe 4796 spoolsv.exe 4884 spoolsv.exe 4884 spoolsv.exe 4456 spoolsv.exe 4456 spoolsv.exe 3996 spoolsv.exe 3996 spoolsv.exe 2416 spoolsv.exe 2416 spoolsv.exe 4288 spoolsv.exe 4288 spoolsv.exe 4324 spoolsv.exe 4324 spoolsv.exe 3940 spoolsv.exe 3940 spoolsv.exe 4416 spoolsv.exe 4416 spoolsv.exe 1164 spoolsv.exe 1164 spoolsv.exe 2492 spoolsv.exe 2492 spoolsv.exe 3976 spoolsv.exe 3976 spoolsv.exe 3124 spoolsv.exe 3124 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 4424 spoolsv.exe 4424 spoolsv.exe 1708 spoolsv.exe 1708 spoolsv.exe 1396 spoolsv.exe 1396 spoolsv.exe 1536 spoolsv.exe 1536 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 3228 spoolsv.exe 3228 spoolsv.exe 1128 spoolsv.exe 1128 spoolsv.exe 3188 spoolsv.exe 3188 spoolsv.exe 3368 spoolsv.exe 3368 spoolsv.exe 1736 spoolsv.exe 1736 spoolsv.exe 1044 spoolsv.exe 1044 spoolsv.exe 4564 spoolsv.exe 4564 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 4200 spoolsv.exe 4200 spoolsv.exe 4364 spoolsv.exe 4364 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exea0a69944b8356d922396a108113d4f05_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1620 wrote to memory of 3992 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe splwow64.exe PID 1620 wrote to memory of 3992 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe splwow64.exe PID 1620 wrote to memory of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 1620 wrote to memory of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 1620 wrote to memory of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 1620 wrote to memory of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 1620 wrote to memory of 4712 1620 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe PID 4712 wrote to memory of 2772 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe explorer.exe PID 4712 wrote to memory of 2772 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe explorer.exe PID 4712 wrote to memory of 2772 4712 a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe explorer.exe PID 2772 wrote to memory of 1828 2772 explorer.exe explorer.exe PID 2772 wrote to memory of 1828 2772 explorer.exe explorer.exe PID 2772 wrote to memory of 1828 2772 explorer.exe explorer.exe PID 2772 wrote to memory of 1828 2772 explorer.exe explorer.exe PID 2772 wrote to memory of 1828 2772 explorer.exe explorer.exe PID 4880 wrote to memory of 2668 4880 spoolsv.exe spoolsv.exe PID 4880 wrote to memory of 2668 4880 spoolsv.exe spoolsv.exe PID 4880 wrote to memory of 2668 4880 spoolsv.exe spoolsv.exe PID 4880 wrote to memory of 2668 4880 spoolsv.exe spoolsv.exe PID 4880 wrote to memory of 2668 4880 spoolsv.exe spoolsv.exe PID 2668 wrote to memory of 4376 2668 spoolsv.exe explorer.exe PID 2668 wrote to memory of 4376 2668 spoolsv.exe explorer.exe PID 2668 wrote to memory of 4376 2668 spoolsv.exe explorer.exe PID 1912 wrote to memory of 4068 1912 spoolsv.exe spoolsv.exe PID 1912 wrote to memory of 4068 1912 spoolsv.exe spoolsv.exe PID 1912 wrote to memory of 4068 1912 spoolsv.exe spoolsv.exe PID 1912 wrote to memory of 4068 1912 spoolsv.exe spoolsv.exe PID 1912 wrote to memory of 4068 1912 spoolsv.exe spoolsv.exe PID 4648 wrote to memory of 4796 4648 spoolsv.exe spoolsv.exe PID 4648 wrote to memory of 4796 4648 spoolsv.exe spoolsv.exe PID 4648 wrote to memory of 4796 4648 spoolsv.exe spoolsv.exe PID 4648 wrote to memory of 4796 4648 spoolsv.exe spoolsv.exe PID 4648 wrote to memory of 4796 4648 spoolsv.exe spoolsv.exe PID 724 wrote to memory of 4884 724 spoolsv.exe spoolsv.exe PID 724 wrote to memory of 4884 724 spoolsv.exe spoolsv.exe PID 724 wrote to memory of 4884 724 spoolsv.exe spoolsv.exe PID 724 wrote to memory of 4884 724 spoolsv.exe spoolsv.exe PID 724 wrote to memory of 4884 724 spoolsv.exe spoolsv.exe PID 1036 wrote to memory of 4456 1036 spoolsv.exe spoolsv.exe PID 1036 wrote to memory of 4456 1036 spoolsv.exe spoolsv.exe PID 1036 wrote to memory of 4456 1036 spoolsv.exe spoolsv.exe PID 1036 wrote to memory of 4456 1036 spoolsv.exe spoolsv.exe PID 1036 wrote to memory of 4456 1036 spoolsv.exe spoolsv.exe PID 2552 wrote to memory of 3996 2552 spoolsv.exe spoolsv.exe PID 2552 wrote to memory of 3996 2552 spoolsv.exe spoolsv.exe PID 2552 wrote to memory of 3996 2552 spoolsv.exe spoolsv.exe PID 2552 wrote to memory of 3996 2552 spoolsv.exe spoolsv.exe PID 2552 wrote to memory of 3996 2552 spoolsv.exe spoolsv.exe PID 4568 wrote to memory of 2416 4568 spoolsv.exe spoolsv.exe PID 4568 wrote to memory of 2416 4568 spoolsv.exe spoolsv.exe PID 4568 wrote to memory of 2416 4568 spoolsv.exe spoolsv.exe PID 4568 wrote to memory of 2416 4568 spoolsv.exe spoolsv.exe PID 4568 wrote to memory of 2416 4568 spoolsv.exe spoolsv.exe PID 1620 wrote to memory of 4288 1620 spoolsv.exe spoolsv.exe PID 1620 wrote to memory of 4288 1620 spoolsv.exe spoolsv.exe PID 1620 wrote to memory of 4288 1620 spoolsv.exe spoolsv.exe PID 1620 wrote to memory of 4288 1620 spoolsv.exe spoolsv.exe PID 1620 wrote to memory of 4288 1620 spoolsv.exe spoolsv.exe PID 4288 wrote to memory of 3696 4288 spoolsv.exe explorer.exe PID 4288 wrote to memory of 3696 4288 spoolsv.exe explorer.exe PID 4288 wrote to memory of 3696 4288 spoolsv.exe explorer.exe PID 1560 wrote to memory of 4324 1560 spoolsv.exe spoolsv.exe PID 1560 wrote to memory of 4324 1560 spoolsv.exe spoolsv.exe PID 1560 wrote to memory of 4324 1560 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:1828 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:4404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3696 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:4304 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1164 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3124 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1424 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:2376 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3016 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4424 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1536 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1404 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:4936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3188 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:1884 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4564 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5112 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:4436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2488 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4364 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5000 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:2576 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4732
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1644 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Executes dropped EXE
PID:1216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1576
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5080
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3676
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5028
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3780
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:4592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:324 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1820
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3872
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1924
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2000
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1252
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1152
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD58a43b88ac01c04e3e3fdf868012332b1
SHA105042474acf5f3efaf28ad6e1346201ea0f9579f
SHA25641a60763e676f4da3e59a8058f9ddbb54091ecaf71f22e5267564ed31e230b47
SHA5128bcc70ac1778f798f660f39f1183cab11baae6d12715b9b002ed57575c11eeab024555806b9dcaa75880fd6951469930b2e9f237abb866b308561191eebbe453