Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 15:05
Behavioral task
behavioral1
Sample
a11808c27300e4e99698968280bb9006_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a11808c27300e4e99698968280bb9006_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a11808c27300e4e99698968280bb9006
-
SHA1
641555789416789757932b794b888bb3f481aca5
-
SHA256
3547eaee0b0fbfeca4b20ab8d794ff46f26cd43b377b480c0d2627e9764367b5
-
SHA512
78a86e07cdd7a59b1e816ca7b422d9d7bfa0385b33a64e040061287327da2237c39814278792bdfdb4ec70aade04d5b4e570ee78e738a2e39491fcf43e1f65e0
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWwwe
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exepid process 2552 explorer.exe 1960 explorer.exe 1936 spoolsv.exe 1564 spoolsv.exe 556 spoolsv.exe 1784 spoolsv.exe 2132 spoolsv.exe 2624 spoolsv.exe 2524 spoolsv.exe 888 spoolsv.exe 2192 spoolsv.exe 1624 spoolsv.exe 2288 spoolsv.exe 1524 spoolsv.exe 1556 spoolsv.exe 2500 spoolsv.exe 2040 spoolsv.exe 2112 spoolsv.exe 1424 spoolsv.exe 3032 spoolsv.exe 648 spoolsv.exe 1716 spoolsv.exe 2496 spoolsv.exe 984 spoolsv.exe 1660 spoolsv.exe 472 spoolsv.exe 1680 spoolsv.exe 872 spoolsv.exe 2724 spoolsv.exe 1372 spoolsv.exe 1732 spoolsv.exe 2308 spoolsv.exe 528 spoolsv.exe 1592 spoolsv.exe 3052 spoolsv.exe 1788 spoolsv.exe 320 spoolsv.exe 892 spoolsv.exe 2248 spoolsv.exe 1736 spoolsv.exe 1668 spoolsv.exe 776 spoolsv.exe 2964 spoolsv.exe 2756 spoolsv.exe 1532 spoolsv.exe 760 spoolsv.exe 1728 spoolsv.exe 2412 spoolsv.exe 932 spoolsv.exe 868 spoolsv.exe 2604 spoolsv.exe 1520 spoolsv.exe 860 spoolsv.exe 580 spoolsv.exe 2800 explorer.exe 3008 spoolsv.exe 1480 spoolsv.exe 1404 spoolsv.exe 2096 spoolsv.exe 1948 spoolsv.exe 1364 spoolsv.exe 1292 explorer.exe 568 spoolsv.exe 2912 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exeexplorer.exepid process 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2932 set thread context of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2552 set thread context of 1960 2552 explorer.exe explorer.exe PID 1564 set thread context of 580 1564 spoolsv.exe spoolsv.exe PID 1936 set thread context of 3008 1936 spoolsv.exe spoolsv.exe PID 556 set thread context of 1480 556 spoolsv.exe spoolsv.exe PID 1784 set thread context of 1404 1784 spoolsv.exe spoolsv.exe PID 2132 set thread context of 1948 2132 spoolsv.exe spoolsv.exe PID 2624 set thread context of 1364 2624 spoolsv.exe spoolsv.exe PID 2524 set thread context of 568 2524 spoolsv.exe spoolsv.exe PID 888 set thread context of 2912 888 spoolsv.exe spoolsv.exe PID 2192 set thread context of 3160 2192 spoolsv.exe spoolsv.exe PID 1624 set thread context of 3180 1624 spoolsv.exe spoolsv.exe PID 1524 set thread context of 3488 1524 spoolsv.exe spoolsv.exe PID 2288 set thread context of 3500 2288 spoolsv.exe spoolsv.exe PID 2500 set thread context of 3580 2500 spoolsv.exe spoolsv.exe PID 1556 set thread context of 3756 1556 spoolsv.exe spoolsv.exe PID 2040 set thread context of 3912 2040 spoolsv.exe spoolsv.exe PID 2112 set thread context of 3996 2112 spoolsv.exe spoolsv.exe PID 1520 set thread context of 3064 1520 spoolsv.exe spoolsv.exe PID 1424 set thread context of 2560 1424 spoolsv.exe spoolsv.exe PID 3032 set thread context of 2540 3032 spoolsv.exe spoolsv.exe PID 648 set thread context of 2716 648 spoolsv.exe spoolsv.exe PID 1716 set thread context of 2084 1716 spoolsv.exe spoolsv.exe PID 2496 set thread context of 3416 2496 spoolsv.exe spoolsv.exe PID 984 set thread context of 1336 984 spoolsv.exe spoolsv.exe PID 472 set thread context of 1152 472 spoolsv.exe spoolsv.exe PID 1660 set thread context of 3624 1660 spoolsv.exe spoolsv.exe PID 1680 set thread context of 3768 1680 spoolsv.exe spoolsv.exe PID 1372 set thread context of 3780 1372 spoolsv.exe spoolsv.exe PID 872 set thread context of 3776 872 spoolsv.exe spoolsv.exe PID 2724 set thread context of 1212 2724 spoolsv.exe spoolsv.exe PID 2308 set thread context of 3940 2308 spoolsv.exe spoolsv.exe PID 1732 set thread context of 4028 1732 spoolsv.exe spoolsv.exe PID 528 set thread context of 1932 528 spoolsv.exe spoolsv.exe PID 1788 set thread context of 2344 1788 spoolsv.exe spoolsv.exe PID 1592 set thread context of 2300 1592 spoolsv.exe spoolsv.exe PID 1736 set thread context of 1320 1736 spoolsv.exe spoolsv.exe PID 892 set thread context of 1264 892 spoolsv.exe spoolsv.exe PID 776 set thread context of 432 776 spoolsv.exe spoolsv.exe PID 2248 set thread context of 3092 2248 spoolsv.exe spoolsv.exe PID 3052 set thread context of 3268 3052 spoolsv.exe spoolsv.exe PID 2756 set thread context of 3436 2756 spoolsv.exe spoolsv.exe PID 760 set thread context of 304 760 spoolsv.exe spoolsv.exe PID 320 set thread context of 3396 320 spoolsv.exe spoolsv.exe PID 1668 set thread context of 1008 1668 spoolsv.exe spoolsv.exe PID 868 set thread context of 3600 868 spoolsv.exe spoolsv.exe PID 2412 set thread context of 2476 2412 spoolsv.exe spoolsv.exe PID 2964 set thread context of 3204 2964 spoolsv.exe spoolsv.exe PID 1728 set thread context of 3084 1728 spoolsv.exe spoolsv.exe PID 1532 set thread context of 1972 1532 spoolsv.exe spoolsv.exe PID 2604 set thread context of 3832 2604 spoolsv.exe spoolsv.exe PID 932 set thread context of 3784 932 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exea11808c27300e4e99698968280bb9006_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea11808c27300e4e99698968280bb9006_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a11808c27300e4e99698968280bb9006_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exeexplorer.exepid process 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1960 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 1960 explorer.exe 580 spoolsv.exe 580 spoolsv.exe 3008 spoolsv.exe 3008 spoolsv.exe 1480 spoolsv.exe 1480 spoolsv.exe 1404 spoolsv.exe 1404 spoolsv.exe 1948 spoolsv.exe 1948 spoolsv.exe 1364 spoolsv.exe 1364 spoolsv.exe 568 spoolsv.exe 568 spoolsv.exe 2912 spoolsv.exe 2912 spoolsv.exe 3160 spoolsv.exe 3160 spoolsv.exe 3180 spoolsv.exe 3180 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe 3500 spoolsv.exe 3500 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 3756 spoolsv.exe 3756 spoolsv.exe 3912 spoolsv.exe 3912 spoolsv.exe 3996 spoolsv.exe 3996 spoolsv.exe 3064 spoolsv.exe 3064 spoolsv.exe 2560 spoolsv.exe 2560 spoolsv.exe 2540 spoolsv.exe 2540 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 2084 spoolsv.exe 2084 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 1336 spoolsv.exe 1336 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 3624 spoolsv.exe 3624 spoolsv.exe 3768 spoolsv.exe 3780 spoolsv.exe 3776 spoolsv.exe 3776 spoolsv.exe 3780 spoolsv.exe 1212 spoolsv.exe 1212 spoolsv.exe 3940 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a11808c27300e4e99698968280bb9006_JaffaCakes118.exea11808c27300e4e99698968280bb9006_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2932 wrote to memory of 1632 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe splwow64.exe PID 2932 wrote to memory of 1632 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe splwow64.exe PID 2932 wrote to memory of 1632 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe splwow64.exe PID 2932 wrote to memory of 1632 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe splwow64.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2932 wrote to memory of 2664 2932 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe a11808c27300e4e99698968280bb9006_JaffaCakes118.exe PID 2664 wrote to memory of 2552 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2552 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2552 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe explorer.exe PID 2664 wrote to memory of 2552 2664 a11808c27300e4e99698968280bb9006_JaffaCakes118.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 2552 wrote to memory of 1960 2552 explorer.exe explorer.exe PID 1960 wrote to memory of 1936 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1936 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1936 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1936 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1564 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1564 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1564 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1564 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 556 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 556 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 556 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 556 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1784 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1784 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1784 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1784 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2132 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2132 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2132 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2132 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2524 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2524 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2524 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2524 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 888 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 888 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 888 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 888 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2192 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2192 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2192 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2192 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 1624 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2288 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2288 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2288 1960 explorer.exe spoolsv.exe PID 1960 wrote to memory of 2288 1960 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a11808c27300e4e99698968280bb9006_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:1292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3160 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3488 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3580 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2084 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3416 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1336 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3768 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3776 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3780 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3268
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1264
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1320
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3204
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3436
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:304
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3064 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2096 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2532 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3412 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2260 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2212 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1304 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1308
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
Filesize
2.2MB
MD5d8ff65a79b4489f3928902352a1716d8
SHA17f601eae32791a4838abb3f7b679da8196e20fb9
SHA25628f8cabbd6ce9ce68d749e094580c1e43a17927fc990e2c8c246d279def70a0f
SHA512b6046b45eae9d295b4e1d81d2afe8271c6e6f012c8764a97ececcad8decc6950eca5d3d57d30bb6edb0572117fff7a3a1ec42f90b828d04d5ccc475420801da9
-
Filesize
2.2MB
MD57b625711c508b64b4999d4670727af10
SHA116ff8afb99b0d0e31f5c575d302df587a0562d6d
SHA256e43995ca1d503bf6fa4f51e75c77600d94fb9badc735fd442eb4c5a859961fbf
SHA5127e9e133117e351aeaa758a425a909a371641fde6f113cea0aa467605dea05ff4b5083cbebbad27401f9826b3224f202e4c4b7694c259c02e6455f81612c0c250