Analysis
-
max time kernel
148s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 13:59
Behavioral task
behavioral1
Sample
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0eab86e21aefe4693198351c17d73fa
-
SHA1
fe601024cce0d5187881364172a02fec78ae412a
-
SHA256
23fae1abda9a95668590a8ef1a6a3d25fa5660880352ca360e5b4e1137405fe1
-
SHA512
67cca3a63b452cac39613190e4a5775ddfe7b29c6157c65bb8ef8f0c6347339b4d38854ea354eb07138447369dc1c46ec75120d5860648610d53e0c634e9460c
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwN
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4884 explorer.exe 60 explorer.exe 3456 spoolsv.exe 5060 spoolsv.exe 4868 spoolsv.exe 1148 spoolsv.exe 2300 spoolsv.exe 3436 spoolsv.exe 644 spoolsv.exe 3620 spoolsv.exe 396 spoolsv.exe 2904 spoolsv.exe 4580 spoolsv.exe 3464 spoolsv.exe 4664 spoolsv.exe 2512 spoolsv.exe 3692 spoolsv.exe 976 spoolsv.exe 3448 spoolsv.exe 3080 spoolsv.exe 2208 spoolsv.exe 3984 spoolsv.exe 4132 spoolsv.exe 4784 spoolsv.exe 1008 spoolsv.exe 2776 spoolsv.exe 8 spoolsv.exe 2116 spoolsv.exe 724 spoolsv.exe 752 spoolsv.exe 2636 spoolsv.exe 1220 spoolsv.exe 3680 spoolsv.exe 1612 explorer.exe 4056 spoolsv.exe 4656 spoolsv.exe 1428 spoolsv.exe 3904 spoolsv.exe 3792 spoolsv.exe 3856 spoolsv.exe 4284 spoolsv.exe 860 explorer.exe 432 spoolsv.exe 428 spoolsv.exe 3328 spoolsv.exe 4876 spoolsv.exe 2348 spoolsv.exe 4184 spoolsv.exe 1392 spoolsv.exe 3948 spoolsv.exe 4308 explorer.exe 2828 spoolsv.exe 348 spoolsv.exe 4616 spoolsv.exe 3332 spoolsv.exe 5040 spoolsv.exe 1948 explorer.exe 4224 spoolsv.exe 3536 spoolsv.exe 2992 spoolsv.exe 2060 spoolsv.exe 2552 spoolsv.exe 2284 spoolsv.exe 5052 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1520 set thread context of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 4884 set thread context of 60 4884 explorer.exe explorer.exe PID 3456 set thread context of 3680 3456 spoolsv.exe spoolsv.exe PID 5060 set thread context of 4056 5060 spoolsv.exe spoolsv.exe PID 4868 set thread context of 4656 4868 spoolsv.exe spoolsv.exe PID 1148 set thread context of 3904 1148 spoolsv.exe spoolsv.exe PID 2300 set thread context of 3792 2300 spoolsv.exe spoolsv.exe PID 3436 set thread context of 3856 3436 spoolsv.exe spoolsv.exe PID 644 set thread context of 4284 644 spoolsv.exe spoolsv.exe PID 3620 set thread context of 432 3620 spoolsv.exe spoolsv.exe PID 396 set thread context of 3328 396 spoolsv.exe spoolsv.exe PID 2904 set thread context of 4876 2904 spoolsv.exe spoolsv.exe PID 4580 set thread context of 2348 4580 spoolsv.exe spoolsv.exe PID 3464 set thread context of 4184 3464 spoolsv.exe spoolsv.exe PID 4664 set thread context of 1392 4664 spoolsv.exe spoolsv.exe PID 2512 set thread context of 3948 2512 spoolsv.exe spoolsv.exe PID 3692 set thread context of 348 3692 spoolsv.exe spoolsv.exe PID 976 set thread context of 4616 976 spoolsv.exe spoolsv.exe PID 3448 set thread context of 3332 3448 spoolsv.exe spoolsv.exe PID 3080 set thread context of 5040 3080 spoolsv.exe spoolsv.exe PID 2208 set thread context of 4224 2208 spoolsv.exe spoolsv.exe PID 3984 set thread context of 2992 3984 spoolsv.exe spoolsv.exe PID 4132 set thread context of 2060 4132 spoolsv.exe spoolsv.exe PID 4784 set thread context of 2552 4784 spoolsv.exe spoolsv.exe PID 1008 set thread context of 2284 1008 spoolsv.exe spoolsv.exe PID 2776 set thread context of 1760 2776 spoolsv.exe spoolsv.exe PID 8 set thread context of 4908 8 spoolsv.exe spoolsv.exe PID 2116 set thread context of 5104 2116 spoolsv.exe spoolsv.exe PID 724 set thread context of 5024 724 spoolsv.exe spoolsv.exe PID 752 set thread context of 4924 752 spoolsv.exe spoolsv.exe PID 2636 set thread context of 1904 2636 spoolsv.exe spoolsv.exe PID 1220 set thread context of 4912 1220 spoolsv.exe spoolsv.exe PID 1612 set thread context of 4980 1612 explorer.exe explorer.exe PID 1428 set thread context of 3176 1428 spoolsv.exe spoolsv.exe PID 860 set thread context of 3956 860 explorer.exe explorer.exe PID 428 set thread context of 2220 428 spoolsv.exe spoolsv.exe PID 4308 set thread context of 2388 4308 explorer.exe explorer.exe PID 2828 set thread context of 3700 2828 spoolsv.exe spoolsv.exe PID 3536 set thread context of 3928 3536 spoolsv.exe spoolsv.exe PID 1948 set thread context of 4632 1948 explorer.exe explorer.exe PID 3708 set thread context of 2364 3708 explorer.exe explorer.exe PID 5052 set thread context of 2256 5052 spoolsv.exe spoolsv.exe PID 4952 set thread context of 2544 4952 spoolsv.exe spoolsv.exe PID 4248 set thread context of 4464 4248 explorer.exe explorer.exe PID 2112 set thread context of 4244 2112 spoolsv.exe spoolsv.exe PID 3796 set thread context of 3352 3796 spoolsv.exe spoolsv.exe PID 3676 set thread context of 4608 3676 explorer.exe explorer.exe PID 4000 set thread context of 4584 4000 spoolsv.exe spoolsv.exe PID 3512 set thread context of 4544 3512 spoolsv.exe spoolsv.exe PID 4684 set thread context of 2820 4684 spoolsv.exe spoolsv.exe PID 4596 set thread context of 4692 4596 spoolsv.exe spoolsv.exe PID 3248 set thread context of 2016 3248 spoolsv.exe spoolsv.exe PID 540 set thread context of 4352 540 explorer.exe explorer.exe PID 1528 set thread context of 4996 1528 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exea0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exeexplorer.exepid process 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 60 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 60 explorer.exe 3680 spoolsv.exe 3680 spoolsv.exe 4056 spoolsv.exe 4056 spoolsv.exe 4656 spoolsv.exe 4656 spoolsv.exe 3904 spoolsv.exe 3904 spoolsv.exe 3792 spoolsv.exe 3792 spoolsv.exe 3856 spoolsv.exe 3856 spoolsv.exe 4284 spoolsv.exe 4284 spoolsv.exe 432 spoolsv.exe 432 spoolsv.exe 3328 spoolsv.exe 3328 spoolsv.exe 4876 spoolsv.exe 4876 spoolsv.exe 2348 spoolsv.exe 2348 spoolsv.exe 4184 spoolsv.exe 4184 spoolsv.exe 1392 spoolsv.exe 1392 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe 348 spoolsv.exe 348 spoolsv.exe 4616 spoolsv.exe 4616 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 5040 spoolsv.exe 5040 spoolsv.exe 4224 spoolsv.exe 4224 spoolsv.exe 2992 spoolsv.exe 2992 spoolsv.exe 2060 spoolsv.exe 2060 spoolsv.exe 2552 spoolsv.exe 2552 spoolsv.exe 2284 spoolsv.exe 2284 spoolsv.exe 1760 spoolsv.exe 1760 spoolsv.exe 4908 spoolsv.exe 4908 spoolsv.exe 5104 spoolsv.exe 5104 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 4924 spoolsv.exe 4924 spoolsv.exe 1904 spoolsv.exe 1904 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exea0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1520 wrote to memory of 3960 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe splwow64.exe PID 1520 wrote to memory of 3960 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe splwow64.exe PID 1520 wrote to memory of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 1520 wrote to memory of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 1520 wrote to memory of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 1520 wrote to memory of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 1520 wrote to memory of 3336 1520 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe PID 3336 wrote to memory of 4884 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe explorer.exe PID 3336 wrote to memory of 4884 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe explorer.exe PID 3336 wrote to memory of 4884 3336 a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe explorer.exe PID 4884 wrote to memory of 60 4884 explorer.exe explorer.exe PID 4884 wrote to memory of 60 4884 explorer.exe explorer.exe PID 4884 wrote to memory of 60 4884 explorer.exe explorer.exe PID 4884 wrote to memory of 60 4884 explorer.exe explorer.exe PID 4884 wrote to memory of 60 4884 explorer.exe explorer.exe PID 60 wrote to memory of 3456 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3456 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3456 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 5060 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 5060 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 5060 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4868 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4868 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4868 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 1148 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 1148 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 1148 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2300 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2300 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2300 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3436 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3436 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3436 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 644 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 644 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 644 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3620 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3620 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3620 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 396 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 396 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 396 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2904 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2904 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2904 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4580 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4580 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4580 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3464 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3464 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3464 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4664 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4664 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 4664 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2512 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2512 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 2512 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3692 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3692 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3692 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 976 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 976 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 976 60 explorer.exe spoolsv.exe PID 60 wrote to memory of 3448 60 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1612 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4656 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3856 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4284 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4580 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3948 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4308 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4616 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1948 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4632
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2992 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1760 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3708 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:8 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5104 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4924 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4912
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3176
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:540 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2220
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3376 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2828 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3700
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3928
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2256
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4244
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3352
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3400 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2016
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4996
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2312
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2172
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4440
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2092 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1796
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4368
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5d274f3f45fc61df0955f3430ff350ebb
SHA1acbb74361bc86e909b119721c91bfd9f66ab196a
SHA2561e060642e33f445beee3f8ddbb7fba3ba7766ee5e7014f81ee027234d9dd6db9
SHA5120a6d91b939f883aa43038e09d01eb1e83595211668b56a9070a833527f7c65430d710e5629d60d8121967c6f1ecc9afff28822bd751826172a92293bc0dbf962
-
Filesize
2.2MB
MD5436e4fdb14679809938afd459c490efc
SHA1b5fe268ae6b1ab68693c7630d2050bf90cbefc94
SHA2564a506204d9f9d8bf15e553b40e869d4ad54eab16546c0509c779a1f8d8565d28
SHA512930e36d34e345dd44eee4725da509317c964290a581a3c308b23499a7443f906981f9f0a1b31ce510b0d9a766e77b00cf04a5e210a8703789815ac3eefc02954