Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 14:01
Behavioral task
behavioral1
Sample
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a0ec040442acea448eb5348ad446074e
-
SHA1
bd37e2307ee387b7c11c832e2183ffa44957de05
-
SHA256
e628905ba905f1021e2ce1f39f5d60d5e3b7136bc3e1877b3bb05f4895d11122
-
SHA512
8377dccd36398b8eff8cdd522b6e4c4ddb0c37649e40ca8b9e2ddd3f022dc549032a9b34dfb0ba0867e992af2ecb1070c335ca717111e94ac5d2a2e0e7ca38a6
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWwwT
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 1212 explorer.exe 644 explorer.exe 3852 spoolsv.exe 1036 spoolsv.exe 992 spoolsv.exe 5028 spoolsv.exe 5072 spoolsv.exe 3216 spoolsv.exe 3332 spoolsv.exe 4992 spoolsv.exe 3532 spoolsv.exe 4844 spoolsv.exe 2080 spoolsv.exe 3528 spoolsv.exe 4248 spoolsv.exe 1292 spoolsv.exe 3644 spoolsv.exe 2868 spoolsv.exe 4056 spoolsv.exe 4804 spoolsv.exe 4748 spoolsv.exe 2216 spoolsv.exe 1948 spoolsv.exe 4568 spoolsv.exe 3104 spoolsv.exe 1252 spoolsv.exe 4292 spoolsv.exe 4516 spoolsv.exe 3680 spoolsv.exe 1440 spoolsv.exe 3208 spoolsv.exe 616 spoolsv.exe 1884 spoolsv.exe 1836 spoolsv.exe 456 spoolsv.exe 864 spoolsv.exe 1192 spoolsv.exe 4908 spoolsv.exe 1224 explorer.exe 4500 spoolsv.exe 4584 spoolsv.exe 4348 spoolsv.exe 4468 spoolsv.exe 4032 spoolsv.exe 2504 spoolsv.exe 4424 spoolsv.exe 4952 explorer.exe 2456 spoolsv.exe 4972 spoolsv.exe 2732 spoolsv.exe 3936 spoolsv.exe 4324 spoolsv.exe 1392 spoolsv.exe 448 spoolsv.exe 1424 explorer.exe 4620 spoolsv.exe 2768 spoolsv.exe 1888 spoolsv.exe 4868 spoolsv.exe 3444 spoolsv.exe 4452 spoolsv.exe 4776 spoolsv.exe 2908 explorer.exe 2764 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
Processes:
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 4296 set thread context of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 1212 set thread context of 644 1212 explorer.exe explorer.exe PID 3852 set thread context of 4908 3852 spoolsv.exe spoolsv.exe PID 1036 set thread context of 4500 1036 spoolsv.exe spoolsv.exe PID 992 set thread context of 4584 992 spoolsv.exe spoolsv.exe PID 5028 set thread context of 4348 5028 spoolsv.exe spoolsv.exe PID 5072 set thread context of 4468 5072 spoolsv.exe spoolsv.exe PID 3216 set thread context of 4032 3216 spoolsv.exe spoolsv.exe PID 3332 set thread context of 4424 3332 spoolsv.exe spoolsv.exe PID 4992 set thread context of 2456 4992 spoolsv.exe spoolsv.exe PID 3532 set thread context of 4972 3532 spoolsv.exe spoolsv.exe PID 4844 set thread context of 2732 4844 spoolsv.exe spoolsv.exe PID 2080 set thread context of 4324 2080 spoolsv.exe spoolsv.exe PID 3528 set thread context of 1392 3528 spoolsv.exe spoolsv.exe PID 4248 set thread context of 448 4248 spoolsv.exe spoolsv.exe PID 1292 set thread context of 4620 1292 spoolsv.exe spoolsv.exe PID 3644 set thread context of 2768 3644 spoolsv.exe spoolsv.exe PID 2868 set thread context of 1888 2868 spoolsv.exe spoolsv.exe PID 4056 set thread context of 4868 4056 spoolsv.exe spoolsv.exe PID 4804 set thread context of 4452 4804 spoolsv.exe spoolsv.exe PID 4748 set thread context of 4776 4748 spoolsv.exe spoolsv.exe PID 2216 set thread context of 2764 2216 spoolsv.exe spoolsv.exe PID 1948 set thread context of 1380 1948 spoolsv.exe spoolsv.exe PID 4568 set thread context of 2780 4568 spoolsv.exe spoolsv.exe PID 3104 set thread context of 2524 3104 spoolsv.exe spoolsv.exe PID 1252 set thread context of 892 1252 spoolsv.exe spoolsv.exe PID 4292 set thread context of 796 4292 spoolsv.exe spoolsv.exe PID 4516 set thread context of 3404 4516 spoolsv.exe spoolsv.exe PID 3680 set thread context of 4480 3680 spoolsv.exe spoolsv.exe PID 1440 set thread context of 3180 1440 spoolsv.exe spoolsv.exe PID 3208 set thread context of 4504 3208 spoolsv.exe spoolsv.exe PID 616 set thread context of 3884 616 spoolsv.exe spoolsv.exe PID 1884 set thread context of 1028 1884 spoolsv.exe spoolsv.exe PID 1836 set thread context of 876 1836 spoolsv.exe spoolsv.exe PID 456 set thread context of 436 456 spoolsv.exe spoolsv.exe PID 864 set thread context of 4276 864 spoolsv.exe spoolsv.exe PID 1192 set thread context of 952 1192 spoolsv.exe spoolsv.exe PID 1224 set thread context of 852 1224 explorer.exe explorer.exe PID 2504 set thread context of 768 2504 spoolsv.exe spoolsv.exe PID 4952 set thread context of 5064 4952 explorer.exe explorer.exe PID 3936 set thread context of 2000 3936 spoolsv.exe spoolsv.exe PID 1424 set thread context of 4224 1424 explorer.exe explorer.exe PID 3444 set thread context of 3816 3444 spoolsv.exe spoolsv.exe PID 2908 set thread context of 2380 2908 explorer.exe explorer.exe PID 3328 set thread context of 3968 3328 explorer.exe explorer.exe PID 1356 set thread context of 1552 1356 spoolsv.exe spoolsv.exe PID 2888 set thread context of 1916 2888 spoolsv.exe spoolsv.exe PID 1592 set thread context of 392 1592 explorer.exe explorer.exe PID 3448 set thread context of 3312 3448 spoolsv.exe spoolsv.exe PID 2008 set thread context of 4132 2008 explorer.exe explorer.exe PID 4556 set thread context of 2184 4556 spoolsv.exe spoolsv.exe PID 5004 set thread context of 3960 5004 spoolsv.exe spoolsv.exe PID 4288 set thread context of 1984 4288 spoolsv.exe spoolsv.exe PID 4456 set thread context of 3080 4456 explorer.exe explorer.exe PID 3304 set thread context of 2272 3304 spoolsv.exe spoolsv.exe PID 684 set thread context of 4048 684 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea0ec040442acea448eb5348ad446074e_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exeexplorer.exepid process 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 644 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 4908 spoolsv.exe 4908 spoolsv.exe 4500 spoolsv.exe 4500 spoolsv.exe 4584 spoolsv.exe 4584 spoolsv.exe 4348 spoolsv.exe 4348 spoolsv.exe 4468 spoolsv.exe 4468 spoolsv.exe 4032 spoolsv.exe 4032 spoolsv.exe 4424 spoolsv.exe 4424 spoolsv.exe 2456 spoolsv.exe 2456 spoolsv.exe 4972 spoolsv.exe 4972 spoolsv.exe 2732 spoolsv.exe 2732 spoolsv.exe 4324 spoolsv.exe 4324 spoolsv.exe 1392 spoolsv.exe 1392 spoolsv.exe 448 spoolsv.exe 448 spoolsv.exe 4620 spoolsv.exe 4620 spoolsv.exe 2768 spoolsv.exe 2768 spoolsv.exe 1888 spoolsv.exe 1888 spoolsv.exe 4868 spoolsv.exe 4868 spoolsv.exe 4452 spoolsv.exe 4452 spoolsv.exe 4776 spoolsv.exe 4776 spoolsv.exe 2764 spoolsv.exe 2764 spoolsv.exe 1380 spoolsv.exe 1380 spoolsv.exe 2780 spoolsv.exe 2780 spoolsv.exe 2524 spoolsv.exe 2524 spoolsv.exe 892 spoolsv.exe 892 spoolsv.exe 796 spoolsv.exe 796 spoolsv.exe 3404 spoolsv.exe 3404 spoolsv.exe 4480 spoolsv.exe 4480 spoolsv.exe 3180 spoolsv.exe 3180 spoolsv.exe 4504 spoolsv.exe 4504 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exea0ec040442acea448eb5348ad446074e_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4296 wrote to memory of 748 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe splwow64.exe PID 4296 wrote to memory of 748 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe splwow64.exe PID 4296 wrote to memory of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 4296 wrote to memory of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 4296 wrote to memory of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 4296 wrote to memory of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 4296 wrote to memory of 1620 4296 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe PID 1620 wrote to memory of 1212 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe explorer.exe PID 1620 wrote to memory of 1212 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe explorer.exe PID 1620 wrote to memory of 1212 1620 a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe explorer.exe PID 1212 wrote to memory of 644 1212 explorer.exe explorer.exe PID 1212 wrote to memory of 644 1212 explorer.exe explorer.exe PID 1212 wrote to memory of 644 1212 explorer.exe explorer.exe PID 1212 wrote to memory of 644 1212 explorer.exe explorer.exe PID 1212 wrote to memory of 644 1212 explorer.exe explorer.exe PID 644 wrote to memory of 3852 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3852 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3852 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1036 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1036 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1036 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5028 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5028 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5028 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5072 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5072 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 5072 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3216 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3216 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3216 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3332 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3332 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3332 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4992 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3532 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3532 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3532 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4844 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4844 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4844 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2080 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2080 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2080 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3528 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3528 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3528 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4248 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4248 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4248 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1292 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1292 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 1292 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3644 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3644 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 3644 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2868 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2868 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 2868 644 explorer.exe spoolsv.exe PID 644 wrote to memory of 4056 644 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1224 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4468 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4424 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4952 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5064
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4972 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4324 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1392 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:448 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1424 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4776 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2908 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2380
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1380 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2780 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2524 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3328 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3180 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1592 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:392
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4504 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:436
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2008 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4132
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:952
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4456 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:768
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2000
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3816
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1552
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1916
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3312
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3960
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3848 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1984
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2272
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4048
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4948
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3628
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4740
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:364
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:468
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1064
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3044
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4164 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4160
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2552 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3712
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3092
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD58a8b4ae098ab2ccb31636f4a49053367
SHA15c06c6c05e72367640cc05e6c82e06ba2580d386
SHA2566d7a04cbf706391599aa7952d56e338e32aa560881c60aa8ee99b4754e7b748f
SHA5126c7d2b611f8672cc399df459ae9acc4d450426d6b120cf3fdfb5ce585bd2b804a17ec8f4f6cd9fe240ea5b3662538a219ba0d3e11a16a67430ee906346634bd2
-
Filesize
2.2MB
MD5f09a2fc2257d33f2f65a4e45283d8be6
SHA11c3a1dbad4b4699e6dd0af754aeaa18853ffd283
SHA256cd119874eed9948aa5b98fad5228fc49259b25402d34095258f7b83eed0f85ea
SHA51209c19c4c1d998beef6572ba906c0107442e5ed5af53e612ca536df17577878424c9c6aa48f8d46ec3c1c4e3033cc3028312007ddf8ca23060f7b0f245048a027