Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 14:49
Behavioral task
behavioral1
Sample
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a10bc331ea2f742117a44570d5babff0
-
SHA1
7f05661bdc6efe27a1039a905a943e1d61d73930
-
SHA256
854e7caed27ffc50df05d4942a8ac451757c13926f08255ce4e66b147f5b819d
-
SHA512
85bf0aed065a5c7bc9c43f90aed7946d85f7504a652906795245282a1e62c91ab84f4b6f0fe5a330532238e9abf83e735714e2c21335b8496efc1b27aaf4fc36
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwQ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 864 explorer.exe 4000 explorer.exe 2424 spoolsv.exe 1788 spoolsv.exe 2088 spoolsv.exe 2032 spoolsv.exe 3028 spoolsv.exe 2068 spoolsv.exe 3788 spoolsv.exe 3660 spoolsv.exe 4012 spoolsv.exe 4836 spoolsv.exe 228 spoolsv.exe 4936 spoolsv.exe 4396 spoolsv.exe 2464 spoolsv.exe 2744 spoolsv.exe 4648 spoolsv.exe 3520 spoolsv.exe 640 spoolsv.exe 2624 spoolsv.exe 4900 spoolsv.exe 3044 spoolsv.exe 2712 spoolsv.exe 5032 spoolsv.exe 1608 spoolsv.exe 4364 spoolsv.exe 1880 spoolsv.exe 4912 spoolsv.exe 4308 spoolsv.exe 864 spoolsv.exe 5236 spoolsv.exe 5316 spoolsv.exe 5372 explorer.exe 5436 spoolsv.exe 5676 spoolsv.exe 5748 spoolsv.exe 5828 spoolsv.exe 5904 spoolsv.exe 5972 spoolsv.exe 5584 spoolsv.exe 5576 spoolsv.exe 5624 explorer.exe 4036 spoolsv.exe 5776 spoolsv.exe 5888 spoolsv.exe 4204 spoolsv.exe 5344 spoolsv.exe 624 explorer.exe 5504 spoolsv.exe 5460 spoolsv.exe 3172 spoolsv.exe 4344 spoolsv.exe 4020 spoolsv.exe 6100 explorer.exe 5184 spoolsv.exe 3464 spoolsv.exe 5324 spoolsv.exe 2356 spoolsv.exe 2484 spoolsv.exe 6016 spoolsv.exe 6048 explorer.exe 6080 spoolsv.exe 5148 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
Processes:
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1884 set thread context of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 864 set thread context of 4000 864 explorer.exe explorer.exe PID 2424 set thread context of 5316 2424 spoolsv.exe spoolsv.exe PID 1788 set thread context of 5436 1788 spoolsv.exe spoolsv.exe PID 2088 set thread context of 5748 2088 spoolsv.exe spoolsv.exe PID 2032 set thread context of 5828 2032 spoolsv.exe spoolsv.exe PID 3028 set thread context of 5904 3028 spoolsv.exe spoolsv.exe PID 2068 set thread context of 5972 2068 spoolsv.exe spoolsv.exe PID 3788 set thread context of 5576 3788 spoolsv.exe spoolsv.exe PID 3660 set thread context of 4036 3660 spoolsv.exe spoolsv.exe PID 4012 set thread context of 5776 4012 spoolsv.exe spoolsv.exe PID 4836 set thread context of 5888 4836 spoolsv.exe spoolsv.exe PID 228 set thread context of 5344 228 spoolsv.exe spoolsv.exe PID 4936 set thread context of 5504 4936 spoolsv.exe spoolsv.exe PID 4396 set thread context of 5460 4396 spoolsv.exe spoolsv.exe PID 2464 set thread context of 3172 2464 spoolsv.exe spoolsv.exe PID 2744 set thread context of 4020 2744 spoolsv.exe spoolsv.exe PID 4648 set thread context of 5184 4648 spoolsv.exe spoolsv.exe PID 3520 set thread context of 3464 3520 spoolsv.exe spoolsv.exe PID 640 set thread context of 5324 640 spoolsv.exe spoolsv.exe PID 2624 set thread context of 2484 2624 spoolsv.exe spoolsv.exe PID 4900 set thread context of 6016 4900 spoolsv.exe spoolsv.exe PID 3044 set thread context of 6080 3044 spoolsv.exe spoolsv.exe PID 2712 set thread context of 5148 2712 spoolsv.exe spoolsv.exe PID 5032 set thread context of 5484 5032 spoolsv.exe spoolsv.exe PID 1608 set thread context of 5136 1608 spoolsv.exe spoolsv.exe PID 4364 set thread context of 4676 4364 spoolsv.exe spoolsv.exe PID 1880 set thread context of 1012 1880 spoolsv.exe spoolsv.exe PID 4912 set thread context of 1892 4912 spoolsv.exe spoolsv.exe PID 4308 set thread context of 6012 4308 spoolsv.exe spoolsv.exe PID 864 set thread context of 5852 864 spoolsv.exe spoolsv.exe PID 5236 set thread context of 5964 5236 spoolsv.exe spoolsv.exe PID 5372 set thread context of 2208 5372 explorer.exe explorer.exe PID 5676 set thread context of 4960 5676 spoolsv.exe spoolsv.exe PID 5584 set thread context of 6104 5584 spoolsv.exe spoolsv.exe PID 5624 set thread context of 2480 5624 explorer.exe explorer.exe PID 4204 set thread context of 4340 4204 spoolsv.exe spoolsv.exe PID 624 set thread context of 3304 624 explorer.exe explorer.exe PID 4344 set thread context of 4084 4344 spoolsv.exe spoolsv.exe PID 6100 set thread context of 6112 6100 explorer.exe explorer.exe PID 2356 set thread context of 5756 2356 spoolsv.exe spoolsv.exe PID 6048 set thread context of 5280 6048 explorer.exe explorer.exe PID 804 set thread context of 5532 804 spoolsv.exe spoolsv.exe PID 5916 set thread context of 5156 5916 explorer.exe explorer.exe PID 2788 set thread context of 5132 2788 spoolsv.exe spoolsv.exe PID 5808 set thread context of 5772 5808 explorer.exe explorer.exe PID 4956 set thread context of 6116 4956 spoolsv.exe spoolsv.exe PID 3000 set thread context of 3236 3000 spoolsv.exe spoolsv.exe PID 180 set thread context of 2340 180 explorer.exe explorer.exe PID 3136 set thread context of 5140 3136 spoolsv.exe spoolsv.exe PID 3004 set thread context of 5272 3004 spoolsv.exe spoolsv.exe PID 1448 set thread context of 5648 1448 spoolsv.exe spoolsv.exe PID 4444 set thread context of 4560 4444 explorer.exe explorer.exe PID 5788 set thread context of 5228 5788 spoolsv.exe spoolsv.exe PID 4280 set thread context of 972 4280 explorer.exe explorer.exe PID 4848 set thread context of 2172 4848 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exea10bc331ea2f742117a44570d5babff0_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exea10bc331ea2f742117a44570d5babff0_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exeexplorer.exepid process 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4000 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 4000 explorer.exe 5316 spoolsv.exe 5316 spoolsv.exe 5436 spoolsv.exe 5436 spoolsv.exe 5748 spoolsv.exe 5748 spoolsv.exe 5828 spoolsv.exe 5828 spoolsv.exe 5904 spoolsv.exe 5904 spoolsv.exe 5972 spoolsv.exe 5972 spoolsv.exe 5576 spoolsv.exe 5576 spoolsv.exe 4036 spoolsv.exe 4036 spoolsv.exe 5776 spoolsv.exe 5776 spoolsv.exe 5888 spoolsv.exe 5888 spoolsv.exe 5344 spoolsv.exe 5344 spoolsv.exe 5504 spoolsv.exe 5504 spoolsv.exe 5460 spoolsv.exe 5460 spoolsv.exe 3172 spoolsv.exe 3172 spoolsv.exe 4020 spoolsv.exe 4020 spoolsv.exe 5184 spoolsv.exe 5184 spoolsv.exe 3464 spoolsv.exe 3464 spoolsv.exe 5324 spoolsv.exe 5324 spoolsv.exe 2484 spoolsv.exe 2484 spoolsv.exe 6016 spoolsv.exe 6016 spoolsv.exe 6080 spoolsv.exe 6080 spoolsv.exe 5148 spoolsv.exe 5148 spoolsv.exe 5484 spoolsv.exe 5484 spoolsv.exe 5136 spoolsv.exe 5136 spoolsv.exe 4676 spoolsv.exe 4676 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 1892 spoolsv.exe 1892 spoolsv.exe 6012 spoolsv.exe 6012 spoolsv.exe 5852 spoolsv.exe 5852 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exea10bc331ea2f742117a44570d5babff0_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1884 wrote to memory of 2364 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 2364 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 1884 wrote to memory of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 1884 wrote to memory of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 1884 wrote to memory of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 1884 wrote to memory of 4712 1884 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe PID 4712 wrote to memory of 864 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe explorer.exe PID 4712 wrote to memory of 864 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe explorer.exe PID 4712 wrote to memory of 864 4712 a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe explorer.exe PID 864 wrote to memory of 4000 864 explorer.exe explorer.exe PID 864 wrote to memory of 4000 864 explorer.exe explorer.exe PID 864 wrote to memory of 4000 864 explorer.exe explorer.exe PID 864 wrote to memory of 4000 864 explorer.exe explorer.exe PID 864 wrote to memory of 4000 864 explorer.exe explorer.exe PID 4000 wrote to memory of 2424 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2424 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2424 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 1788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 1788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 1788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2088 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2088 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2088 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2032 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2032 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2032 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3028 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3028 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3028 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2068 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2068 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2068 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3788 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3660 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3660 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3660 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4012 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4012 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4012 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4836 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4836 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4836 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 228 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 228 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 228 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4936 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4936 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4936 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4396 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4396 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4396 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2464 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2464 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2464 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2744 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2744 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 2744 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4648 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4648 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 4648 4000 explorer.exe spoolsv.exe PID 4000 wrote to memory of 3520 4000 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a10bc331ea2f742117a44570d5babff0_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5316 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5372 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5436 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5828 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5576 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5624 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4036 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:624 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5504 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4020 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6100 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:6112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3464 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2484 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6016 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6048 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5280
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5484 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5136 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5916 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:6012 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5808 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5964
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:180 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2340
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4960
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4444 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4560
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6104
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4280 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4340
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4084
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5756
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5532
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5132
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3236
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5140
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5272
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2172
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2316 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1092 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5512 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:81⤵PID:2696
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD59cc996362b7143ca7d49a9f03e53918b
SHA1dfb50f9d31904e3e85ffd41f37dc21a94bd01775
SHA2564e557b25ecbb3c59cf0408df745cfa9f74b913b5ffafaa68b30fb9d2e995f33d
SHA512182c928fa98da2baccfaf7b848a4df1916493f15b91a6b8883f8c8feb83b748240eee9fa41d0689b5eeb1a75cf4d7fbd3f26c5b293e248274e2456a8b296540e
-
Filesize
2.2MB
MD555938a2d04fe8695e7d076e6b2620c91
SHA158b969f9d30510b05db4f21ae9479b2a56001494
SHA2564883586c94fbaefb22bb5d5704103a7fb79860000f0f413a2a128f8d500f5378
SHA51283eb845685624bf1d41527781b6027db6e3100871fdf58320f57e6ced72b70b49dc5cbcc49a4d55f97f45ca2318ba4b532b482070ad98676b9ee7a0db87a2d4e