Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 15:16
Behavioral task
behavioral1
Sample
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a11ee99b39139c4b7846ca561b5d9481
-
SHA1
e08938817c75c4d60fa3f40e49e6e0fdc95987b3
-
SHA256
3c7fbe834d0a1e7dc5f80771d09a42a09454dfab3757fcfa6d21a3322eaa1a86
-
SHA512
cbcbcbeda42f8f7605fc59fbcf579fe25d63ec3318a2c2b37db01a502e0fc348fdafdf636b9c361fda0deb426df853023a89e616a9a36e6fb39b2ea5d8a7cad3
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWww/
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1320 explorer.exe 4344 explorer.exe 3652 spoolsv.exe 5112 spoolsv.exe 1508 spoolsv.exe 2060 spoolsv.exe 2984 spoolsv.exe 3620 spoolsv.exe 4908 spoolsv.exe 1400 spoolsv.exe 1056 spoolsv.exe 2772 spoolsv.exe 4652 spoolsv.exe 3112 spoolsv.exe 3972 spoolsv.exe 3604 spoolsv.exe 1604 spoolsv.exe 1588 spoolsv.exe 4612 spoolsv.exe 2496 spoolsv.exe 2864 spoolsv.exe 1180 spoolsv.exe 4844 spoolsv.exe 4804 spoolsv.exe 4636 spoolsv.exe 4644 spoolsv.exe 1220 spoolsv.exe 4752 spoolsv.exe 3472 spoolsv.exe 916 spoolsv.exe 3412 spoolsv.exe 2708 spoolsv.exe 2992 spoolsv.exe 4896 spoolsv.exe 5044 explorer.exe 2936 spoolsv.exe 3212 spoolsv.exe 1228 spoolsv.exe 3156 spoolsv.exe 228 spoolsv.exe 3440 spoolsv.exe 4736 spoolsv.exe 3608 explorer.exe 404 spoolsv.exe 4988 spoolsv.exe 2108 spoolsv.exe 3356 spoolsv.exe 4832 spoolsv.exe 1876 explorer.exe 4152 spoolsv.exe 2716 spoolsv.exe 400 spoolsv.exe 2192 spoolsv.exe 3648 spoolsv.exe 1872 spoolsv.exe 4348 spoolsv.exe 3952 spoolsv.exe 3080 explorer.exe 2188 spoolsv.exe 3332 spoolsv.exe 2432 spoolsv.exe 4568 spoolsv.exe 2836 spoolsv.exe 5072 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 5064 set thread context of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 1320 set thread context of 4344 1320 explorer.exe explorer.exe PID 3652 set thread context of 4896 3652 spoolsv.exe spoolsv.exe PID 5112 set thread context of 2936 5112 spoolsv.exe spoolsv.exe PID 1508 set thread context of 1228 1508 spoolsv.exe spoolsv.exe PID 2060 set thread context of 3156 2060 spoolsv.exe spoolsv.exe PID 2984 set thread context of 228 2984 spoolsv.exe spoolsv.exe PID 3620 set thread context of 3440 3620 spoolsv.exe spoolsv.exe PID 4908 set thread context of 4736 4908 spoolsv.exe spoolsv.exe PID 1400 set thread context of 404 1400 spoolsv.exe spoolsv.exe PID 1056 set thread context of 4988 1056 spoolsv.exe spoolsv.exe PID 2772 set thread context of 3356 2772 spoolsv.exe spoolsv.exe PID 4652 set thread context of 4832 4652 spoolsv.exe spoolsv.exe PID 3112 set thread context of 4152 3112 spoolsv.exe spoolsv.exe PID 3972 set thread context of 2716 3972 spoolsv.exe spoolsv.exe PID 3604 set thread context of 400 3604 spoolsv.exe spoolsv.exe PID 1604 set thread context of 3648 1604 spoolsv.exe spoolsv.exe PID 1588 set thread context of 1872 1588 spoolsv.exe spoolsv.exe PID 4612 set thread context of 3952 4612 spoolsv.exe spoolsv.exe PID 2496 set thread context of 2188 2496 spoolsv.exe spoolsv.exe PID 2864 set thread context of 3332 2864 spoolsv.exe spoolsv.exe PID 1180 set thread context of 2432 1180 spoolsv.exe spoolsv.exe PID 4844 set thread context of 4568 4844 spoolsv.exe spoolsv.exe PID 4804 set thread context of 5072 4804 spoolsv.exe spoolsv.exe PID 4636 set thread context of 516 4636 spoolsv.exe spoolsv.exe PID 4644 set thread context of 5052 4644 spoolsv.exe spoolsv.exe PID 1220 set thread context of 2116 1220 spoolsv.exe spoolsv.exe PID 4752 set thread context of 4288 4752 spoolsv.exe spoolsv.exe PID 3472 set thread context of 4356 3472 spoolsv.exe spoolsv.exe PID 916 set thread context of 2372 916 spoolsv.exe spoolsv.exe PID 3412 set thread context of 3548 3412 spoolsv.exe spoolsv.exe PID 2708 set thread context of 2324 2708 spoolsv.exe spoolsv.exe PID 2992 set thread context of 1768 2992 spoolsv.exe spoolsv.exe PID 5044 set thread context of 4388 5044 explorer.exe explorer.exe PID 3212 set thread context of 644 3212 spoolsv.exe spoolsv.exe PID 3608 set thread context of 2024 3608 explorer.exe explorer.exe PID 2108 set thread context of 2268 2108 spoolsv.exe spoolsv.exe PID 1876 set thread context of 2004 1876 explorer.exe explorer.exe PID 2192 set thread context of 4784 2192 spoolsv.exe spoolsv.exe PID 3080 set thread context of 3700 3080 explorer.exe explorer.exe PID 4348 set thread context of 1920 4348 spoolsv.exe spoolsv.exe PID 4216 set thread context of 4976 4216 explorer.exe explorer.exe PID 2836 set thread context of 3664 2836 spoolsv.exe spoolsv.exe PID 3816 set thread context of 4936 3816 spoolsv.exe spoolsv.exe PID 1320 set thread context of 1560 1320 explorer.exe explorer.exe PID 2500 set thread context of 4600 2500 spoolsv.exe spoolsv.exe PID 4992 set thread context of 1916 4992 explorer.exe explorer.exe PID 312 set thread context of 1052 312 spoolsv.exe spoolsv.exe PID 4244 set thread context of 3832 4244 spoolsv.exe spoolsv.exe PID 4972 set thread context of 1256 4972 explorer.exe explorer.exe PID 1704 set thread context of 4536 1704 spoolsv.exe spoolsv.exe PID 4284 set thread context of 3340 4284 spoolsv.exe spoolsv.exe PID 3940 set thread context of 1416 3940 spoolsv.exe spoolsv.exe PID 3960 set thread context of 2020 3960 spoolsv.exe spoolsv.exe PID 3088 set thread context of 2736 3088 explorer.exe explorer.exe PID 2288 set thread context of 3968 2288 spoolsv.exe spoolsv.exe PID 4088 set thread context of 832 4088 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exeexplorer.exepid process 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4344 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4344 explorer.exe 4896 spoolsv.exe 4896 spoolsv.exe 2936 spoolsv.exe 2936 spoolsv.exe 1228 spoolsv.exe 1228 spoolsv.exe 3156 spoolsv.exe 3156 spoolsv.exe 228 spoolsv.exe 228 spoolsv.exe 3440 spoolsv.exe 3440 spoolsv.exe 4736 spoolsv.exe 4736 spoolsv.exe 404 spoolsv.exe 404 spoolsv.exe 4988 spoolsv.exe 4988 spoolsv.exe 3356 spoolsv.exe 3356 spoolsv.exe 4832 spoolsv.exe 4832 spoolsv.exe 4152 spoolsv.exe 4152 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 400 spoolsv.exe 400 spoolsv.exe 3648 spoolsv.exe 3648 spoolsv.exe 1872 spoolsv.exe 1872 spoolsv.exe 3952 spoolsv.exe 3952 spoolsv.exe 2188 spoolsv.exe 2188 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 2432 spoolsv.exe 2432 spoolsv.exe 4568 spoolsv.exe 4568 spoolsv.exe 5072 spoolsv.exe 5072 spoolsv.exe 516 spoolsv.exe 516 spoolsv.exe 5052 spoolsv.exe 5052 spoolsv.exe 2116 spoolsv.exe 2116 spoolsv.exe 4288 spoolsv.exe 4288 spoolsv.exe 4356 spoolsv.exe 4356 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 3548 spoolsv.exe 3548 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exea11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 5064 wrote to memory of 632 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe splwow64.exe PID 5064 wrote to memory of 632 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe splwow64.exe PID 5064 wrote to memory of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 5064 wrote to memory of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 5064 wrote to memory of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 5064 wrote to memory of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 5064 wrote to memory of 2460 5064 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe PID 2460 wrote to memory of 1320 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe explorer.exe PID 2460 wrote to memory of 1320 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe explorer.exe PID 2460 wrote to memory of 1320 2460 a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe explorer.exe PID 1320 wrote to memory of 4344 1320 explorer.exe explorer.exe PID 1320 wrote to memory of 4344 1320 explorer.exe explorer.exe PID 1320 wrote to memory of 4344 1320 explorer.exe explorer.exe PID 1320 wrote to memory of 4344 1320 explorer.exe explorer.exe PID 1320 wrote to memory of 4344 1320 explorer.exe explorer.exe PID 4344 wrote to memory of 3652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 5112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 5112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 5112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1508 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1508 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1508 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2060 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2060 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2060 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2984 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2984 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2984 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3620 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3620 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3620 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4908 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4908 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4908 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1400 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1400 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1400 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1056 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1056 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1056 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2772 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2772 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 2772 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4652 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3112 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3972 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3972 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3972 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 3604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1604 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1588 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1588 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 1588 4344 explorer.exe spoolsv.exe PID 4344 wrote to memory of 4612 4344 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a11ee99b39139c4b7846ca561b5d9481_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4896 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5044 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4736 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3608 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4832 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:400 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3648 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3952 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3080 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3700
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2188 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4216 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5052 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2116 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1320 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1560
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4356 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2372 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3548 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2324
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4992 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1916
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1768
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4972 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1256
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:644
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2736
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2268
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2568 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2648
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4784
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2516 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3664
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4372
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4936
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3340
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1416
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2020
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:832
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4920
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2668 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4720 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2304 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2340 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4996 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5fa063988d44fe703c6a729fe0410213b
SHA11a692d6534327370b66c6fe4d30a8741b9f90406
SHA256f2ac4b1d75380d90fd7d84bd6774d624cc5a336d8e56621700a3c8b69ab4cd55
SHA51250d8108c40d07137caf879c12b88fac7db11ee607893b91faaef5c79ea30d773bc23f290f1803826025bd2e798f733ae7620ca410be24dfa8ba319abdaae5145
-
Filesize
2.2MB
MD59009990ec45004c831cc551ae6ccb96e
SHA1129f7aa1b76023e76f5197ae6df7cce6208d4246
SHA25608902f8081af7d1b95f73a63033f4548ef84f667125fe1cd15e2255d6adf4ce4
SHA5124830dc2cf55adcf929d14631094a249ce8b4b433681fa5d6ff3047a877bfd5699b84cbdfe6f336510dffa7f4d68c94c886004b083fea6da277c587091960645d