Analysis
-
max time kernel
148s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 16:16
Behavioral task
behavioral1
Sample
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a14a8e35be8d1f2451945699f0672852
-
SHA1
3e1e09d122d62c5051883e0baf4c9dfefa084ad7
-
SHA256
ba2bd42f285b14fe2b37c9e595d91bb8a8368b22b1388a2a626a00378e72d424
-
SHA512
e54855feb564f72dd5f0db46c742182a9d110ad70225306dc8a9f6be7e6d523d00b96e4b2e5ba7aa9bf9d2e95ad659cc2d1247115fa329c9ed9cced12f780abe
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwK
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 3412 explorer.exe 3172 explorer.exe 2388 spoolsv.exe 5048 spoolsv.exe 1060 spoolsv.exe 3552 spoolsv.exe 1052 spoolsv.exe 3676 spoolsv.exe 3616 spoolsv.exe 2300 spoolsv.exe 4764 spoolsv.exe 4532 spoolsv.exe 3524 spoolsv.exe 1196 spoolsv.exe 700 spoolsv.exe 4428 spoolsv.exe 4220 spoolsv.exe 1500 spoolsv.exe 4392 spoolsv.exe 4536 spoolsv.exe 696 spoolsv.exe 5068 spoolsv.exe 2660 spoolsv.exe 1892 spoolsv.exe 880 spoolsv.exe 4172 spoolsv.exe 812 spoolsv.exe 5076 spoolsv.exe 760 spoolsv.exe 820 spoolsv.exe 2840 spoolsv.exe 2536 spoolsv.exe 3780 spoolsv.exe 4272 explorer.exe 1012 spoolsv.exe 3820 spoolsv.exe 1560 spoolsv.exe 3620 spoolsv.exe 2864 spoolsv.exe 2184 spoolsv.exe 2964 explorer.exe 1508 spoolsv.exe 920 spoolsv.exe 2196 spoolsv.exe 5024 spoolsv.exe 3368 spoolsv.exe 2616 spoolsv.exe 3260 explorer.exe 448 spoolsv.exe 1260 spoolsv.exe 3920 spoolsv.exe 4976 spoolsv.exe 2956 spoolsv.exe 1372 spoolsv.exe 1000 explorer.exe 1568 spoolsv.exe 4852 spoolsv.exe 1392 spoolsv.exe 1172 explorer.exe 4952 spoolsv.exe 1784 spoolsv.exe 4528 spoolsv.exe 3596 spoolsv.exe 3648 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exedescription pid process target process PID 5028 set thread context of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 3412 set thread context of 3172 3412 explorer.exe explorer.exe PID 2388 set thread context of 3780 2388 spoolsv.exe spoolsv.exe PID 5048 set thread context of 1012 5048 spoolsv.exe spoolsv.exe PID 1060 set thread context of 1560 1060 spoolsv.exe spoolsv.exe PID 3552 set thread context of 3620 3552 spoolsv.exe spoolsv.exe PID 1052 set thread context of 2864 1052 spoolsv.exe spoolsv.exe PID 3676 set thread context of 2184 3676 spoolsv.exe spoolsv.exe PID 3616 set thread context of 920 3616 spoolsv.exe spoolsv.exe PID 2300 set thread context of 2196 2300 spoolsv.exe spoolsv.exe PID 4764 set thread context of 5024 4764 spoolsv.exe spoolsv.exe PID 3524 set thread context of 2616 3524 spoolsv.exe spoolsv.exe PID 1196 set thread context of 1260 1196 spoolsv.exe spoolsv.exe PID 700 set thread context of 3920 700 spoolsv.exe spoolsv.exe PID 4428 set thread context of 4976 4428 spoolsv.exe spoolsv.exe PID 4220 set thread context of 1372 4220 spoolsv.exe spoolsv.exe PID 1500 set thread context of 1568 1500 spoolsv.exe spoolsv.exe PID 4392 set thread context of 4852 4392 spoolsv.exe spoolsv.exe PID 4536 set thread context of 1392 4536 spoolsv.exe spoolsv.exe PID 696 set thread context of 4952 696 spoolsv.exe spoolsv.exe PID 5068 set thread context of 4528 5068 spoolsv.exe spoolsv.exe PID 2660 set thread context of 3596 2660 spoolsv.exe spoolsv.exe PID 1892 set thread context of 3648 1892 spoolsv.exe spoolsv.exe PID 880 set thread context of 1804 880 spoolsv.exe spoolsv.exe PID 4172 set thread context of 4816 4172 spoolsv.exe spoolsv.exe PID 812 set thread context of 4920 812 spoolsv.exe spoolsv.exe PID 5076 set thread context of 3044 5076 spoolsv.exe spoolsv.exe PID 760 set thread context of 932 760 spoolsv.exe spoolsv.exe PID 820 set thread context of 3236 820 spoolsv.exe spoolsv.exe PID 2840 set thread context of 4796 2840 spoolsv.exe spoolsv.exe PID 2536 set thread context of 1300 2536 spoolsv.exe spoolsv.exe PID 4272 set thread context of 3144 4272 explorer.exe explorer.exe PID 3820 set thread context of 1824 3820 spoolsv.exe spoolsv.exe PID 2964 set thread context of 2548 2964 explorer.exe explorer.exe PID 1508 set thread context of 3684 1508 spoolsv.exe spoolsv.exe PID 3260 set thread context of 3968 3260 explorer.exe explorer.exe PID 448 set thread context of 4964 448 spoolsv.exe spoolsv.exe PID 1000 set thread context of 404 1000 explorer.exe explorer.exe PID 2956 set thread context of 1772 2956 spoolsv.exe spoolsv.exe PID 1172 set thread context of 3904 1172 explorer.exe explorer.exe PID 1784 set thread context of 3328 1784 spoolsv.exe spoolsv.exe PID 3976 set thread context of 4868 3976 explorer.exe explorer.exe PID 1076 set thread context of 2556 1076 spoolsv.exe spoolsv.exe PID 4544 set thread context of 2524 4544 explorer.exe explorer.exe PID 4880 set thread context of 4328 4880 spoolsv.exe spoolsv.exe PID 1624 set thread context of 3624 1624 spoolsv.exe spoolsv.exe PID 4452 set thread context of 4000 4452 explorer.exe explorer.exe PID 4636 set thread context of 5012 4636 spoolsv.exe spoolsv.exe PID 1556 set thread context of 2880 1556 explorer.exe explorer.exe PID 1672 set thread context of 2052 1672 spoolsv.exe spoolsv.exe PID 4820 set thread context of 2512 4820 spoolsv.exe spoolsv.exe PID 3104 set thread context of 960 3104 spoolsv.exe spoolsv.exe PID 4440 set thread context of 3708 4440 explorer.exe explorer.exe PID 3716 set thread context of 2236 3716 spoolsv.exe spoolsv.exe PID 3672 set thread context of 3100 3672 spoolsv.exe spoolsv.exe PID 1808 set thread context of 2852 1808 spoolsv.exe spoolsv.exe PID 4512 set thread context of 2144 4512 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exea14a8e35be8d1f2451945699f0672852_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exea14a8e35be8d1f2451945699f0672852_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exeexplorer.exepid process 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3172 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3172 explorer.exe 3780 spoolsv.exe 3780 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 1560 spoolsv.exe 1560 spoolsv.exe 3620 spoolsv.exe 3620 spoolsv.exe 2864 spoolsv.exe 2864 spoolsv.exe 2184 spoolsv.exe 2184 spoolsv.exe 920 spoolsv.exe 920 spoolsv.exe 2196 spoolsv.exe 2196 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 3368 spoolsv.exe 3368 spoolsv.exe 2616 spoolsv.exe 2616 spoolsv.exe 1260 spoolsv.exe 1260 spoolsv.exe 3920 spoolsv.exe 3920 spoolsv.exe 4976 spoolsv.exe 4976 spoolsv.exe 1372 spoolsv.exe 1372 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 4852 spoolsv.exe 4852 spoolsv.exe 1392 spoolsv.exe 1392 spoolsv.exe 4952 spoolsv.exe 4952 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 3596 spoolsv.exe 3596 spoolsv.exe 3648 spoolsv.exe 3648 spoolsv.exe 1804 spoolsv.exe 1804 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 4920 spoolsv.exe 4920 spoolsv.exe 3044 spoolsv.exe 3044 spoolsv.exe 932 spoolsv.exe 932 spoolsv.exe 3236 spoolsv.exe 3236 spoolsv.exe 4796 spoolsv.exe 4796 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exea14a8e35be8d1f2451945699f0672852_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 5028 wrote to memory of 2060 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe splwow64.exe PID 5028 wrote to memory of 2060 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe splwow64.exe PID 5028 wrote to memory of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 5028 wrote to memory of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 5028 wrote to memory of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 5028 wrote to memory of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 5028 wrote to memory of 456 5028 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe PID 456 wrote to memory of 3412 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe explorer.exe PID 456 wrote to memory of 3412 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe explorer.exe PID 456 wrote to memory of 3412 456 a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe explorer.exe PID 3412 wrote to memory of 3172 3412 explorer.exe explorer.exe PID 3412 wrote to memory of 3172 3412 explorer.exe explorer.exe PID 3412 wrote to memory of 3172 3412 explorer.exe explorer.exe PID 3412 wrote to memory of 3172 3412 explorer.exe explorer.exe PID 3412 wrote to memory of 3172 3412 explorer.exe explorer.exe PID 3172 wrote to memory of 2388 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 2388 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 2388 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 5048 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 5048 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 5048 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1060 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1060 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1060 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3552 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3552 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3552 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1052 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1052 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1052 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3676 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3676 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3676 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3616 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3616 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3616 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 2300 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 2300 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 2300 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4764 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4764 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4764 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4532 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4532 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4532 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3524 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3524 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 3524 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1196 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1196 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1196 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 700 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 700 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 700 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4428 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4428 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4428 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4220 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4220 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4220 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1500 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1500 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 1500 3172 explorer.exe spoolsv.exe PID 3172 wrote to memory of 4392 3172 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a14a8e35be8d1f2451945699f0672852_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3780 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4272 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1012 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3676 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2184 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2964 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2548
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2196 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5024 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3368 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3260 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1372 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1000 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4852 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1392 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1172 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4952 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3648 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3976 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1804 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4920 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3044 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4544 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2524
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4796 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1300
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1556 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2880
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1824
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4440 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3684
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:4512 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2144
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4964
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1772
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1420 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2556
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2512
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4956 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2236
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3100
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3460
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3892 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4940 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2456 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2564
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3408
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1380 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3140
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD559e94fb264b71f8a3b3b4691a857cfb4
SHA1454dbed14b406e69a50007d2cb39f8a5972e189b
SHA256297db05c91a6c4f1c1f56783593597bbdd22d575889019208c0a1058a27470a2
SHA512c076f5ffa9449a80971aaeca4454eab7e7d70860ac2048dc1e8cdfcf27322c5be7f3e6819a97713efc613dad431f2d75c6bccfe1dbc66268793afe7fb766bc6e
-
Filesize
2.2MB
MD57ac696eed4855e30f752828373cb16b7
SHA12f1bea6b40211615274eb63b1e7da5eaee01ac70
SHA256b16638630b77f0696ba61f18f783ef4e6527358377880e9dcdf0564c6f0022a1
SHA512a619b5882b8fa70f5f4504cf80ddc32441d8a2656966c6292e80052e6cecb49a29c94e17879d03232f614d1a7846c5781cebdf64a5226b55a98c8467b8f61072