Analysis
-
max time kernel
110s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 16:30
Behavioral task
behavioral1
Sample
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a155cf4486e613b70815f0ec6ec59fc3
-
SHA1
04b0c9033d850e544a7048226837efff27132670
-
SHA256
6b395bd50e69395ed51f4982103de8556371a94f61953954f8dfe1117ab7f7a4
-
SHA512
13cfc28cee30b15662d9968e5316105f9c48a0b52424da7866811102343c3bd078e2c0673d9ffcc102305d002c8f075dd4b8b37aac9a8158e03e9c989d82ccba
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwD
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 1364 explorer.exe 788 explorer.exe 3972 spoolsv.exe 2772 spoolsv.exe 3704 spoolsv.exe 4088 spoolsv.exe 2008 spoolsv.exe 4756 spoolsv.exe 4856 spoolsv.exe 3244 spoolsv.exe 4832 spoolsv.exe 960 spoolsv.exe 3464 spoolsv.exe 1672 spoolsv.exe 3860 spoolsv.exe 4016 spoolsv.exe 4532 spoolsv.exe 3912 spoolsv.exe 4440 spoolsv.exe 3044 spoolsv.exe 4964 spoolsv.exe 4804 spoolsv.exe 3204 spoolsv.exe 3936 spoolsv.exe 1780 spoolsv.exe 4652 spoolsv.exe 4604 explorer.exe 2276 spoolsv.exe 3892 spoolsv.exe 4516 explorer.exe 4168 spoolsv.exe 396 spoolsv.exe 3120 spoolsv.exe 2876 explorer.exe 3404 spoolsv.exe 2292 spoolsv.exe 1564 spoolsv.exe 3368 explorer.exe 3152 spoolsv.exe 428 spoolsv.exe 404 spoolsv.exe 3924 explorer.exe 4208 spoolsv.exe 4184 spoolsv.exe 2744 spoolsv.exe 2892 explorer.exe 4104 spoolsv.exe 1348 spoolsv.exe 3616 spoolsv.exe 4340 spoolsv.exe 2228 explorer.exe 1792 spoolsv.exe 2340 spoolsv.exe 3984 spoolsv.exe 4480 explorer.exe 3476 spoolsv.exe 3748 spoolsv.exe 1804 spoolsv.exe 1036 explorer.exe 4360 spoolsv.exe 5112 spoolsv.exe 3252 spoolsv.exe 1216 spoolsv.exe 1292 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 20 IoCs
Processes:
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2556 set thread context of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 1364 set thread context of 788 1364 explorer.exe explorer.exe PID 3972 set thread context of 4652 3972 spoolsv.exe spoolsv.exe PID 2772 set thread context of 3892 2772 spoolsv.exe spoolsv.exe PID 3704 set thread context of 4168 3704 spoolsv.exe spoolsv.exe PID 4088 set thread context of 3120 4088 spoolsv.exe spoolsv.exe PID 2008 set thread context of 2292 2008 spoolsv.exe spoolsv.exe PID 4756 set thread context of 1564 4756 spoolsv.exe spoolsv.exe PID 4856 set thread context of 428 4856 spoolsv.exe spoolsv.exe PID 3244 set thread context of 404 3244 spoolsv.exe spoolsv.exe PID 4832 set thread context of 4184 4832 spoolsv.exe spoolsv.exe PID 960 set thread context of 2744 960 spoolsv.exe spoolsv.exe PID 3464 set thread context of 1348 3464 spoolsv.exe spoolsv.exe PID 1672 set thread context of 4340 1672 spoolsv.exe spoolsv.exe PID 3860 set thread context of 1792 3860 spoolsv.exe spoolsv.exe PID 4016 set thread context of 3984 4016 spoolsv.exe spoolsv.exe PID 4532 set thread context of 3748 4532 spoolsv.exe spoolsv.exe PID 3912 set thread context of 1804 3912 spoolsv.exe spoolsv.exe PID 4440 set thread context of 5112 4440 spoolsv.exe spoolsv.exe PID 3044 set thread context of 1216 3044 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 47 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exea155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exea155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exeexplorer.exepid process 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe -
Suspicious use of SetWindowsHookEx 42 IoCs
Processes:
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 788 explorer.exe 4652 spoolsv.exe 4652 spoolsv.exe 3892 spoolsv.exe 3892 spoolsv.exe 4168 spoolsv.exe 4168 spoolsv.exe 3120 spoolsv.exe 3120 spoolsv.exe 2292 spoolsv.exe 2292 spoolsv.exe 1564 spoolsv.exe 1564 spoolsv.exe 428 spoolsv.exe 428 spoolsv.exe 404 spoolsv.exe 404 spoolsv.exe 4184 spoolsv.exe 4184 spoolsv.exe 2744 spoolsv.exe 2744 spoolsv.exe 1348 spoolsv.exe 1348 spoolsv.exe 4340 spoolsv.exe 4340 spoolsv.exe 1792 spoolsv.exe 1792 spoolsv.exe 3984 spoolsv.exe 3984 spoolsv.exe 3748 spoolsv.exe 3748 spoolsv.exe 1804 spoolsv.exe 1804 spoolsv.exe 5112 spoolsv.exe 5112 spoolsv.exe 1216 spoolsv.exe 1216 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exea155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2556 wrote to memory of 220 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe splwow64.exe PID 2556 wrote to memory of 220 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe splwow64.exe PID 2556 wrote to memory of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 2556 wrote to memory of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 2556 wrote to memory of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 2556 wrote to memory of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 2556 wrote to memory of 2476 2556 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe PID 2476 wrote to memory of 1364 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe explorer.exe PID 2476 wrote to memory of 1364 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe explorer.exe PID 2476 wrote to memory of 1364 2476 a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe explorer.exe PID 1364 wrote to memory of 788 1364 explorer.exe explorer.exe PID 1364 wrote to memory of 788 1364 explorer.exe explorer.exe PID 1364 wrote to memory of 788 1364 explorer.exe explorer.exe PID 1364 wrote to memory of 788 1364 explorer.exe explorer.exe PID 1364 wrote to memory of 788 1364 explorer.exe explorer.exe PID 788 wrote to memory of 3972 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3972 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3972 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2772 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2772 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2772 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3704 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3704 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3704 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4088 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4088 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4088 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2008 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2008 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 2008 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4756 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4756 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4756 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4856 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4856 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4856 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3244 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3244 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3244 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4832 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4832 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4832 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 960 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 960 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 960 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3464 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3464 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3464 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 1672 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 1672 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 1672 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3860 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3860 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3860 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4016 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4016 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4016 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4532 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4532 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4532 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3912 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3912 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 3912 788 explorer.exe spoolsv.exe PID 788 wrote to memory of 4440 788 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a155cf4486e613b70815f0ec6ec59fc3_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4652 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4604 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3812
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3892 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4516 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4168 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3120 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1564 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3368 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:428 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3924 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2892 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3744
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4340 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2228 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1792 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3984 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4596
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1036 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:1292 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5004
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4776
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4364
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5028
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2824
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2200
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3132
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4492
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2972
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2468
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:464
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1364
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2352
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2780
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3428
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1908
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2816
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2304
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2004
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4860
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4012
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:540
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1472
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4556
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1740
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4020
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2404
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4148
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1756
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1832
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3764
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3416
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2540
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5048
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3696
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2156
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1736
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2240
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD55617f47c5a1c43cc3eeccb9c5f963f07
SHA1b3f7de3dead859803c9639ae36c195747a4fcb81
SHA256f2dd4d04512727856b0c84d0615dc38482fbf9183ecaefe6eb786260b7b4436a
SHA512f733a77fb20f781d32d1dddc174c9fc916a013f6d2b2531666c0fd53a580e5580ebcbc2a39a99bdccafc607f38db834d2a2cb474879e7e5008438e1fe96c9531
-
Filesize
2.2MB
MD59e60d9f5cc181ae10b03c24ed0688b78
SHA15798f5e810450df3c5894a408012486b5ca54903
SHA256adacf89e86ad12afb16294ddd8ea4b061f73a25a33eff928577b4ab2d3475856
SHA51251cb62265fceae327eb8bee04d93b821ccf02332f9f9dc9cfdb693a1a482181af70fa39f657077f24909f66aca528ce3f3957cb4341387ab53b80313693d6592