Analysis
-
max time kernel
148s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 14:43
Behavioral task
behavioral1
Sample
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a10703677d0e427a756bbefad450a74d
-
SHA1
68fa6212bc1c2dc3ed7c79e859cae4cc1a12257b
-
SHA256
e2e88104cd583d83340a0cada31043d1e567aa0ea9fbeaf0f7495d2631ae99e5
-
SHA512
d4d80eb983a687080d4c328f7415a5c71b3ee450211a9998f9e2f5166365c26d7724f802b254a3ca3f3ce9138ace7566fd5139e5f920c366a0d034606f58c516
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWww1
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2960 explorer.exe 2744 explorer.exe 1552 spoolsv.exe 2212 spoolsv.exe 604 spoolsv.exe 2360 spoolsv.exe 1656 spoolsv.exe 2612 spoolsv.exe 2712 spoolsv.exe 3000 spoolsv.exe 1532 spoolsv.exe 2204 spoolsv.exe 584 spoolsv.exe 1696 spoolsv.exe 2276 spoolsv.exe 284 spoolsv.exe 2016 spoolsv.exe 1780 spoolsv.exe 2948 spoolsv.exe 1276 spoolsv.exe 544 spoolsv.exe 2364 spoolsv.exe 2220 spoolsv.exe 2072 spoolsv.exe 2616 spoolsv.exe 1484 spoolsv.exe 2740 spoolsv.exe 1996 spoolsv.exe 1216 spoolsv.exe 964 spoolsv.exe 2728 spoolsv.exe 2272 spoolsv.exe 2992 spoolsv.exe 1944 spoolsv.exe 832 spoolsv.exe 1028 spoolsv.exe 2156 spoolsv.exe 2424 spoolsv.exe 2592 spoolsv.exe 324 spoolsv.exe 2044 spoolsv.exe 1816 spoolsv.exe 2704 spoolsv.exe 2956 spoolsv.exe 2388 spoolsv.exe 1940 spoolsv.exe 320 spoolsv.exe 2964 spoolsv.exe 2348 spoolsv.exe 808 spoolsv.exe 900 spoolsv.exe 1588 spoolsv.exe 2880 spoolsv.exe 2524 spoolsv.exe 2856 spoolsv.exe 1708 spoolsv.exe 1256 spoolsv.exe 2460 spoolsv.exe 2252 spoolsv.exe 1652 spoolsv.exe 1540 spoolsv.exe 1112 spoolsv.exe 2528 spoolsv.exe 564 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exeexplorer.exepid process 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 11 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2168 set thread context of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2960 set thread context of 2744 2960 explorer.exe explorer.exe PID 1552 set thread context of 3988 1552 spoolsv.exe spoolsv.exe PID 2212 set thread context of 4044 2212 spoolsv.exe spoolsv.exe PID 2360 set thread context of 3232 2360 spoolsv.exe spoolsv.exe PID 604 set thread context of 2928 604 spoolsv.exe spoolsv.exe PID 2016 set thread context of 4420 2016 spoolsv.exe spoolsv.exe PID 2528 set thread context of 4540 2528 spoolsv.exe spoolsv.exe PID 1656 set thread context of 4764 1656 spoolsv.exe spoolsv.exe PID 2612 set thread context of 4876 2612 spoolsv.exe spoolsv.exe PID 2592 set thread context of 4860 2592 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea10703677d0e427a756bbefad450a74d_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exeexplorer.exepid process 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2744 explorer.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 2744 explorer.exe 3988 spoolsv.exe 3988 spoolsv.exe 4044 spoolsv.exe 4044 spoolsv.exe 3232 spoolsv.exe 3232 spoolsv.exe 2928 spoolsv.exe 2928 spoolsv.exe 4540 spoolsv.exe 4540 spoolsv.exe 4876 spoolsv.exe 4876 spoolsv.exe 4764 spoolsv.exe 4764 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a10703677d0e427a756bbefad450a74d_JaffaCakes118.exea10703677d0e427a756bbefad450a74d_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2168 wrote to memory of 2100 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe splwow64.exe PID 2168 wrote to memory of 2100 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe splwow64.exe PID 2168 wrote to memory of 2100 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe splwow64.exe PID 2168 wrote to memory of 2100 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe splwow64.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2168 wrote to memory of 2448 2168 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe PID 2448 wrote to memory of 2960 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe explorer.exe PID 2448 wrote to memory of 2960 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe explorer.exe PID 2448 wrote to memory of 2960 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe explorer.exe PID 2448 wrote to memory of 2960 2448 a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2960 wrote to memory of 2744 2960 explorer.exe explorer.exe PID 2744 wrote to memory of 1552 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1552 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1552 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1552 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2212 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2212 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2212 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2212 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 604 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 604 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 604 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 604 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2360 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2360 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2360 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2360 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1656 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1656 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1656 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1656 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2612 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2612 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2612 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2612 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2712 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2712 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2712 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2712 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 3000 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 3000 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 3000 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 3000 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1532 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1532 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1532 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 1532 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2204 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2204 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2204 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 2204 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 584 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 584 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 584 2744 explorer.exe spoolsv.exe PID 2744 wrote to memory of 584 2744 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a10703677d0e427a756bbefad450a74d_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2508
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4420
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1780 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1276 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1484 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2272 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2992 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1944 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4860
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2388 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:320 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2880 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2856 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1652 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2124 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2656
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2400 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2672 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3292
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3452
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3936
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3420
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3704 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2660
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3376
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3896
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3140
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3712 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3524 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3968 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3880 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3604
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1324
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4780
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
2.2MB
MD5c858aecd70c7103ab8474c8f7ac15ce5
SHA160e492f7650527d593482b14f99d628eb8af17ff
SHA25673c8b0e115d9c7176da29896ed826fc042b42408441ba714d7137e809bb06469
SHA5123507bcaa855ee7bf4c87d3d7fbf153e46edde164e923a01c4278e30c3a6893b4d5fb5fc9d19204f249f898715fe6494a6cdf78404554686308fc41cae6886b53
-
Filesize
2.2MB
MD5d8a2643b2b075248c1e33dbefed6e16e
SHA106722e9e3f3597ceff269b16a44267cae8744d4d
SHA2563838eb4f4922e81830a2b11cdd62c4ae38eee2bf09a1a035a850fb62c9f64a6a
SHA512d5c94fbda831e0918fa86ad340ba4e9a450a7b00499da893f2d99cf20b5376a0fad16fb71d14006a36c9c29c43e65de378d32a8fdda1e17b792d060ea42f8461