Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 13:55
Behavioral task
behavioral1
Sample
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0e72faba3dd93dcc999bd0930708e9f
-
SHA1
2946975ce77a7684f469603faf06e089f42eccd1
-
SHA256
51db3cf0ea5d99cc7a9d358f32f296967b5b612617d482ea0515e4df69b9be35
-
SHA512
e5d6371d409582858c1e667d58a201ec2da3235e3b0bf4431209c2a3f5573a21b1d1ff35c4cd4ed8cd81240c6346693da173237749ccb3b8e7633da59a2f491e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwQ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2484 explorer.exe 1836 explorer.exe 2012 spoolsv.exe 3000 spoolsv.exe 844 spoolsv.exe 2368 spoolsv.exe 2136 spoolsv.exe 1760 spoolsv.exe 2572 spoolsv.exe 3032 spoolsv.exe 2620 spoolsv.exe 1624 spoolsv.exe 2096 spoolsv.exe 1500 spoolsv.exe 2168 spoolsv.exe 2352 spoolsv.exe 2576 spoolsv.exe 2868 spoolsv.exe 1816 spoolsv.exe 1788 spoolsv.exe 2788 spoolsv.exe 2960 spoolsv.exe 1768 spoolsv.exe 2932 spoolsv.exe 2748 spoolsv.exe 2740 spoolsv.exe 2636 spoolsv.exe 3012 spoolsv.exe 1484 spoolsv.exe 1800 spoolsv.exe 2044 spoolsv.exe 2532 spoolsv.exe 2968 spoolsv.exe 1692 spoolsv.exe 2176 spoolsv.exe 672 spoolsv.exe 572 spoolsv.exe 1936 spoolsv.exe 2664 spoolsv.exe 2956 spoolsv.exe 2380 spoolsv.exe 2396 spoolsv.exe 2200 spoolsv.exe 2648 spoolsv.exe 2468 spoolsv.exe 1764 spoolsv.exe 1708 spoolsv.exe 2500 spoolsv.exe 2496 spoolsv.exe 2276 spoolsv.exe 1596 spoolsv.exe 2260 spoolsv.exe 2848 spoolsv.exe 908 spoolsv.exe 3028 spoolsv.exe 1572 spoolsv.exe 636 spoolsv.exe 1564 spoolsv.exe 2964 spoolsv.exe 836 spoolsv.exe 292 spoolsv.exe 1640 spoolsv.exe 2476 spoolsv.exe 2036 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exeexplorer.exepid process 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2856 set thread context of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2484 set thread context of 1836 2484 explorer.exe explorer.exe PID 2012 set thread context of 4120 2012 spoolsv.exe spoolsv.exe PID 844 set thread context of 4192 844 spoolsv.exe spoolsv.exe PID 2368 set thread context of 4280 2368 spoolsv.exe spoolsv.exe PID 3000 set thread context of 4308 3000 spoolsv.exe spoolsv.exe PID 1760 set thread context of 4968 1760 spoolsv.exe spoolsv.exe PID 3012 set thread context of 4976 3012 spoolsv.exe spoolsv.exe PID 3032 set thread context of 4132 3032 spoolsv.exe spoolsv.exe PID 1500 set thread context of 4224 1500 spoolsv.exe spoolsv.exe PID 3040 set thread context of 4536 3040 spoolsv.exe spoolsv.exe PID 2168 set thread context of 4160 2168 spoolsv.exe spoolsv.exe PID 2620 set thread context of 5176 2620 spoolsv.exe spoolsv.exe PID 2136 set thread context of 4484 2136 spoolsv.exe spoolsv.exe PID 2572 set thread context of 4528 2572 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exea0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exeexplorer.exepid process 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1836 explorer.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 1836 explorer.exe 4120 spoolsv.exe 4120 spoolsv.exe 4192 spoolsv.exe 4192 spoolsv.exe 4976 spoolsv.exe 4132 spoolsv.exe 4132 spoolsv.exe 4224 spoolsv.exe 4224 spoolsv.exe 4968 spoolsv.exe 4968 spoolsv.exe 4976 spoolsv.exe 4280 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exea0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2856 wrote to memory of 1196 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe splwow64.exe PID 2856 wrote to memory of 1196 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe splwow64.exe PID 2856 wrote to memory of 1196 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe splwow64.exe PID 2856 wrote to memory of 1196 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe splwow64.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2856 wrote to memory of 2760 2856 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe PID 2760 wrote to memory of 2484 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe explorer.exe PID 2760 wrote to memory of 2484 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe explorer.exe PID 2760 wrote to memory of 2484 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe explorer.exe PID 2760 wrote to memory of 2484 2760 a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 2484 wrote to memory of 1836 2484 explorer.exe explorer.exe PID 1836 wrote to memory of 2012 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2012 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2012 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2012 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3000 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3000 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3000 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3000 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 844 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 844 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 844 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 844 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2368 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2368 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2368 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2368 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2136 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2136 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2136 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2136 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1760 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1760 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1760 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1760 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2572 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2572 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2572 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2572 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3032 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3032 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3032 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 3032 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2620 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2620 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2620 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2620 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1624 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1624 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1624 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 1624 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2096 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2096 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2096 1836 explorer.exe spoolsv.exe PID 1836 wrote to memory of 2096 1836 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0e72faba3dd93dcc999bd0930708e9f_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4120 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4192 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4528
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5176
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4160
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5296
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5788
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5556
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5804
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5700
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5420
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4736
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2848 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1640 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2476 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2608 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:760
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5672
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3104
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3748
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4072
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3180
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6048
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3828 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6064
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4252
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3308 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3560
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3800
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3292
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3536 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2236
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3252
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3608 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3424
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3652
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3132 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3532
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3508
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3120
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3732 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2684
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6128
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3808
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4384
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5620
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5d93d26895687d7e39e0548e71abd6da7
SHA1ad3830ddac97cfc7abbe5c762aa613b1df29e61a
SHA2561f447f5d23b9654b7c32ebdcc92858b6f7600e04f1a4d3a469e7c3096dee0cca
SHA512ae5c8de32f2e2561189b4d5abb54f34f78942ea80a6db4492339c8bf8e8fc552578c1a0d1b0429efbcd7d29f59ca9480f7f3861c914af18518522eac8900656c
-
Filesize
2.2MB
MD557d3b2729567f67aaf0adad9a055ebf5
SHA18b8a29208234dc53262426301c9c1824033aec75
SHA2564b38d4be23f8bfe4f92683a4c20d596acc7bec1aea0901bf9a29b568c2f7e5dd
SHA5126548ec73a32904452a4591a2132dd363f5cd3a0198c0019b1a65b810e8a54b196d772cdf1efc2cc71ddcc6012bd56db98d9fc89f9d1e751592c338df2afbe7c3