Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 16:03
Behavioral task
behavioral1
Sample
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a140dce0b2ac25e3ff31af73a7309702
-
SHA1
8af95bf99541cdd50e04d0725a93a00925c32af4
-
SHA256
76647ae0a547e3901599612a1c5747ed2d3a23505f642c8ee3ff90c488bd3951
-
SHA512
fdea4b31208ef6ee4f19549a09b2c82785dc879551693c304c52a80a43e1899d4535dad587f8efaa916cc95ebc3577eb078fd263dd1175e5f6e5f5f3f13217ee
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWwwQ
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 4976 explorer.exe 1908 explorer.exe 3804 spoolsv.exe 4336 spoolsv.exe 3196 spoolsv.exe 4260 spoolsv.exe 3920 spoolsv.exe 3708 spoolsv.exe 2040 spoolsv.exe 2252 spoolsv.exe 4712 spoolsv.exe 4848 spoolsv.exe 1264 spoolsv.exe 4832 spoolsv.exe 4512 spoolsv.exe 2364 spoolsv.exe 4724 spoolsv.exe 4428 spoolsv.exe 2800 spoolsv.exe 2400 spoolsv.exe 964 spoolsv.exe 4952 spoolsv.exe 2088 spoolsv.exe 3472 spoolsv.exe 732 spoolsv.exe 4932 spoolsv.exe 4980 spoolsv.exe 4860 spoolsv.exe 1420 spoolsv.exe 1856 spoolsv.exe 2472 spoolsv.exe 3640 spoolsv.exe 4352 spoolsv.exe 2484 spoolsv.exe 2816 spoolsv.exe 3020 explorer.exe 4592 spoolsv.exe 2456 spoolsv.exe 2600 spoolsv.exe 2432 spoolsv.exe 2860 spoolsv.exe 4340 spoolsv.exe 1440 spoolsv.exe 1328 spoolsv.exe 2256 explorer.exe 716 spoolsv.exe 1572 spoolsv.exe 4396 spoolsv.exe 3716 spoolsv.exe 3832 spoolsv.exe 1400 explorer.exe 4040 spoolsv.exe 4584 spoolsv.exe 1688 spoolsv.exe 2420 spoolsv.exe 3476 spoolsv.exe 624 spoolsv.exe 3300 spoolsv.exe 2944 explorer.exe 2408 spoolsv.exe 4240 spoolsv.exe 3504 spoolsv.exe 3264 spoolsv.exe 2340 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 58 IoCs
Processes:
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 1928 set thread context of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 4976 set thread context of 1908 4976 explorer.exe explorer.exe PID 3804 set thread context of 2816 3804 spoolsv.exe spoolsv.exe PID 4336 set thread context of 4592 4336 spoolsv.exe spoolsv.exe PID 3196 set thread context of 2456 3196 spoolsv.exe spoolsv.exe PID 4260 set thread context of 2600 4260 spoolsv.exe spoolsv.exe PID 3920 set thread context of 2432 3920 spoolsv.exe spoolsv.exe PID 3708 set thread context of 2860 3708 spoolsv.exe spoolsv.exe PID 2040 set thread context of 1440 2040 spoolsv.exe spoolsv.exe PID 2252 set thread context of 1328 2252 spoolsv.exe spoolsv.exe PID 4712 set thread context of 1572 4712 spoolsv.exe spoolsv.exe PID 4848 set thread context of 4396 4848 spoolsv.exe spoolsv.exe PID 1264 set thread context of 3716 1264 spoolsv.exe spoolsv.exe PID 4832 set thread context of 3832 4832 spoolsv.exe spoolsv.exe PID 4512 set thread context of 4584 4512 spoolsv.exe spoolsv.exe PID 2364 set thread context of 1688 2364 spoolsv.exe spoolsv.exe PID 4724 set thread context of 2420 4724 spoolsv.exe spoolsv.exe PID 4428 set thread context of 3476 4428 spoolsv.exe spoolsv.exe PID 2800 set thread context of 3300 2800 spoolsv.exe spoolsv.exe PID 2400 set thread context of 2408 2400 spoolsv.exe spoolsv.exe PID 964 set thread context of 4240 964 spoolsv.exe spoolsv.exe PID 4952 set thread context of 3264 4952 spoolsv.exe spoolsv.exe PID 2088 set thread context of 1152 2088 spoolsv.exe spoolsv.exe PID 3472 set thread context of 4200 3472 spoolsv.exe spoolsv.exe PID 732 set thread context of 4456 732 spoolsv.exe spoolsv.exe PID 4932 set thread context of 872 4932 spoolsv.exe spoolsv.exe PID 4980 set thread context of 3740 4980 spoolsv.exe spoolsv.exe PID 4860 set thread context of 3928 4860 spoolsv.exe spoolsv.exe PID 1420 set thread context of 4912 1420 spoolsv.exe spoolsv.exe PID 1856 set thread context of 4432 1856 spoolsv.exe spoolsv.exe PID 2472 set thread context of 2640 2472 spoolsv.exe spoolsv.exe PID 3640 set thread context of 1668 3640 spoolsv.exe spoolsv.exe PID 4352 set thread context of 3424 4352 spoolsv.exe spoolsv.exe PID 2484 set thread context of 4496 2484 spoolsv.exe spoolsv.exe PID 3020 set thread context of 2732 3020 explorer.exe explorer.exe PID 4340 set thread context of 4128 4340 spoolsv.exe spoolsv.exe PID 2256 set thread context of 5100 2256 explorer.exe explorer.exe PID 716 set thread context of 3216 716 spoolsv.exe spoolsv.exe PID 1400 set thread context of 1872 1400 explorer.exe explorer.exe PID 4040 set thread context of 4404 4040 spoolsv.exe spoolsv.exe PID 624 set thread context of 1928 624 spoolsv.exe spoolsv.exe PID 2944 set thread context of 2568 2944 explorer.exe explorer.exe PID 3504 set thread context of 2292 3504 spoolsv.exe spoolsv.exe PID 2340 set thread context of 220 2340 explorer.exe explorer.exe PID 3404 set thread context of 4416 3404 spoolsv.exe spoolsv.exe PID 3552 set thread context of 3108 3552 explorer.exe explorer.exe PID 3880 set thread context of 5208 3880 spoolsv.exe spoolsv.exe PID 4452 set thread context of 5316 4452 explorer.exe explorer.exe PID 444 set thread context of 5400 444 spoolsv.exe spoolsv.exe PID 3652 set thread context of 5456 3652 explorer.exe explorer.exe PID 2688 set thread context of 5536 2688 spoolsv.exe spoolsv.exe PID 2616 set thread context of 3664 2616 spoolsv.exe spoolsv.exe PID 4548 set thread context of 424 4548 spoolsv.exe spoolsv.exe PID 736 set thread context of 5136 736 explorer.exe explorer.exe PID 2956 set thread context of 5248 2956 spoolsv.exe spoolsv.exe PID 2352 set thread context of 2188 2352 explorer.exe explorer.exe PID 4688 set thread context of 2744 4688 spoolsv.exe spoolsv.exe PID 4500 set thread context of 6132 4500 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exea140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exea140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exeexplorer.exepid process 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1908 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 1908 explorer.exe 2816 spoolsv.exe 2816 spoolsv.exe 4592 spoolsv.exe 4592 spoolsv.exe 2456 spoolsv.exe 2456 spoolsv.exe 2600 spoolsv.exe 2600 spoolsv.exe 2432 spoolsv.exe 2432 spoolsv.exe 2860 spoolsv.exe 2860 spoolsv.exe 1440 spoolsv.exe 1440 spoolsv.exe 1328 spoolsv.exe 1328 spoolsv.exe 1572 spoolsv.exe 1572 spoolsv.exe 4396 spoolsv.exe 4396 spoolsv.exe 3716 spoolsv.exe 3716 spoolsv.exe 3832 spoolsv.exe 3832 spoolsv.exe 4584 spoolsv.exe 4584 spoolsv.exe 1688 spoolsv.exe 1688 spoolsv.exe 2420 spoolsv.exe 2420 spoolsv.exe 3476 spoolsv.exe 3476 spoolsv.exe 3300 spoolsv.exe 3300 spoolsv.exe 2408 spoolsv.exe 2408 spoolsv.exe 4240 spoolsv.exe 4240 spoolsv.exe 3264 spoolsv.exe 3264 spoolsv.exe 1152 spoolsv.exe 1152 spoolsv.exe 4200 spoolsv.exe 4200 spoolsv.exe 4456 spoolsv.exe 4456 spoolsv.exe 872 spoolsv.exe 872 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 3928 spoolsv.exe 3928 spoolsv.exe 4912 spoolsv.exe 4912 spoolsv.exe 4432 spoolsv.exe 4432 spoolsv.exe 2640 spoolsv.exe 2640 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exea140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1928 wrote to memory of 4648 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe splwow64.exe PID 1928 wrote to memory of 4648 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe splwow64.exe PID 1928 wrote to memory of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 1928 wrote to memory of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 1928 wrote to memory of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 1928 wrote to memory of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 1928 wrote to memory of 2092 1928 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe PID 2092 wrote to memory of 4976 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe explorer.exe PID 2092 wrote to memory of 4976 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe explorer.exe PID 2092 wrote to memory of 4976 2092 a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe explorer.exe PID 4976 wrote to memory of 1908 4976 explorer.exe explorer.exe PID 4976 wrote to memory of 1908 4976 explorer.exe explorer.exe PID 4976 wrote to memory of 1908 4976 explorer.exe explorer.exe PID 4976 wrote to memory of 1908 4976 explorer.exe explorer.exe PID 4976 wrote to memory of 1908 4976 explorer.exe explorer.exe PID 1908 wrote to memory of 3804 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3804 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3804 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4336 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4336 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4336 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3196 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3196 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3196 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4260 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4260 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4260 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3920 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3920 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3920 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3708 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3708 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 3708 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2040 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2040 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2040 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2252 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2252 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2252 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4712 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4712 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4712 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4848 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4848 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4848 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 1264 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 1264 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 1264 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4832 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4832 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4832 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4512 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4512 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4512 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2364 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2364 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2364 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4724 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4724 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4724 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4428 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4428 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 4428 1908 explorer.exe spoolsv.exe PID 1908 wrote to memory of 2800 1908 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a140dce0b2ac25e3ff31af73a7309702_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3020 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4592 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1328 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3832 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1400 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1872
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4584 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1688 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3300 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2944 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2568
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4240 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2340 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4200 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3740 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3552 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4432 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1668
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3424
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3652 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4496
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:736 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4128
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2352 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2188
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3216
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4404
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4324
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1928
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1836 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2292
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2760 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4416
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2032
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5208
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5268 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3664
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2892
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:424
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:2956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6132
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3224
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3800
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4364 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5180 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6096 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3128
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1684,i,15316930299780304231,7592852768794498680,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD593ad7db8e564b7ccc56631f6a6bc07d4
SHA1fd537b6bef253410c74eb02d6cb7f7bacaecf286
SHA2560825ed9d38096083c996ed0e5455604ee65eec40b245c290df73cdb099d342c2
SHA512e4040633e59c82c72bda5b8bd0361c0c740ca720296d6603d08ff9f2ae22a19303afe40c2e05fd7f76625f8457746eb7126e59bfea85d971ed8cca75fdbce569
-
Filesize
2.2MB
MD5aae5b6b5e4ce7812a0104dd378030b57
SHA15e382c548bb02153e5e13bb34df90c8cba889855
SHA256f2f8c4f6fbcf287417935d1d3903d50895187629bd25fe7f26d1781a4499440f
SHA512d1f150b7f7a9283473d5f91269198965b4907b3bc724b9be43d9d34ff99aa464a84ffe247ed2aa657dc24a49c6d95c837229e7a67bd43717cfbf08fb294f9c08