Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 06:20
Behavioral task
behavioral1
Sample
a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a84d68930ccf65fa12d349bfab110ae8
-
SHA1
d0f2e8de0acc6a75d3929f3f6c88386009fe6eca
-
SHA256
451dafd9e1245f42e984199b88fdaea35192f29d271c235200df7fe6a8317a23
-
SHA512
2484c692eb69dc83802c907977f863f9ddc87421cc56f12bdf9ed11e7b05542aa0a4990a0242f5d2f686d4dce16f61358e7f87af6ef46fc6794f340fa5b4bd1a
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWwwH
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3840 explorer.exe 4816 explorer.exe 4764 spoolsv.exe 1212 spoolsv.exe 320 spoolsv.exe 4300 spoolsv.exe 1664 spoolsv.exe 460 spoolsv.exe 5004 spoolsv.exe 3016 spoolsv.exe 3460 spoolsv.exe 2396 spoolsv.exe 4568 spoolsv.exe 672 spoolsv.exe 464 spoolsv.exe 3952 spoolsv.exe 4792 spoolsv.exe 1912 spoolsv.exe 4512 spoolsv.exe 1916 spoolsv.exe 2652 spoolsv.exe 2084 spoolsv.exe 916 spoolsv.exe 2308 spoolsv.exe 860 spoolsv.exe 1532 spoolsv.exe 1508 spoolsv.exe 2140 spoolsv.exe 1768 spoolsv.exe 4504 spoolsv.exe 3128 spoolsv.exe 2344 spoolsv.exe 2316 explorer.exe 4280 spoolsv.exe 3856 spoolsv.exe 376 spoolsv.exe 4072 explorer.exe 3096 spoolsv.exe 4828 spoolsv.exe 2876 spoolsv.exe 3148 spoolsv.exe 1380 spoolsv.exe 2420 explorer.exe 1540 spoolsv.exe 1872 spoolsv.exe 3340 spoolsv.exe 1524 spoolsv.exe 1424 spoolsv.exe 1376 explorer.exe 2696 spoolsv.exe 3140 spoolsv.exe 1168 spoolsv.exe 2856 spoolsv.exe 4968 spoolsv.exe 4344 explorer.exe 4876 spoolsv.exe 432 spoolsv.exe 4784 spoolsv.exe 1908 spoolsv.exe 1224 spoolsv.exe 4592 explorer.exe 948 spoolsv.exe 2636 spoolsv.exe 4864 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 55 IoCs
description pid Process procid_target PID 4456 set thread context of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 3840 set thread context of 4816 3840 explorer.exe 97 PID 4764 set thread context of 2344 4764 spoolsv.exe 127 PID 1212 set thread context of 3856 1212 spoolsv.exe 130 PID 320 set thread context of 376 320 spoolsv.exe 131 PID 4300 set thread context of 3096 4300 spoolsv.exe 133 PID 1664 set thread context of 4828 1664 spoolsv.exe 134 PID 460 set thread context of 3148 460 spoolsv.exe 136 PID 5004 set thread context of 1380 5004 spoolsv.exe 137 PID 3016 set thread context of 1540 3016 spoolsv.exe 139 PID 3460 set thread context of 1872 3460 spoolsv.exe 140 PID 2396 set thread context of 1524 2396 spoolsv.exe 142 PID 4568 set thread context of 1424 4568 spoolsv.exe 143 PID 672 set thread context of 2696 672 spoolsv.exe 145 PID 464 set thread context of 3140 464 spoolsv.exe 146 PID 3952 set thread context of 2856 3952 spoolsv.exe 148 PID 4792 set thread context of 4968 4792 spoolsv.exe 149 PID 1912 set thread context of 4876 1912 spoolsv.exe 151 PID 4512 set thread context of 4784 4512 spoolsv.exe 153 PID 1916 set thread context of 1908 1916 spoolsv.exe 154 PID 2652 set thread context of 1224 2652 spoolsv.exe 155 PID 2084 set thread context of 948 2084 spoolsv.exe 157 PID 916 set thread context of 2636 916 spoolsv.exe 158 PID 2308 set thread context of 4864 2308 spoolsv.exe 159 PID 860 set thread context of 3204 860 spoolsv.exe 161 PID 1532 set thread context of 1920 1532 spoolsv.exe 162 PID 1508 set thread context of 648 1508 spoolsv.exe 164 PID 2140 set thread context of 4144 2140 spoolsv.exe 165 PID 1768 set thread context of 3740 1768 spoolsv.exe 166 PID 4504 set thread context of 2388 4504 spoolsv.exe 168 PID 3128 set thread context of 2080 3128 spoolsv.exe 171 PID 2316 set thread context of 3904 2316 explorer.exe 173 PID 4280 set thread context of 3012 4280 spoolsv.exe 176 PID 4072 set thread context of 4956 4072 explorer.exe 179 PID 2876 set thread context of 632 2876 spoolsv.exe 181 PID 2420 set thread context of 1384 2420 explorer.exe 183 PID 3340 set thread context of 2708 3340 spoolsv.exe 186 PID 1376 set thread context of 664 1376 explorer.exe 188 PID 1168 set thread context of 3320 1168 spoolsv.exe 191 PID 4344 set thread context of 3652 4344 explorer.exe 194 PID 432 set thread context of 4004 432 spoolsv.exe 198 PID 4592 set thread context of 224 4592 explorer.exe 202 PID 4464 set thread context of 2464 4464 spoolsv.exe 204 PID 3364 set thread context of 2872 3364 explorer.exe 206 PID 1760 set thread context of 944 1760 spoolsv.exe 208 PID 2056 set thread context of 4984 2056 explorer.exe 209 PID 2884 set thread context of 3852 2884 spoolsv.exe 211 PID 1356 set thread context of 1660 1356 explorer.exe 213 PID 3724 set thread context of 832 3724 spoolsv.exe 214 PID 3608 set thread context of 3116 3608 spoolsv.exe 216 PID 544 set thread context of 3860 544 explorer.exe 218 PID 1388 set thread context of 2724 1388 spoolsv.exe 220 PID 4516 set thread context of 3948 4516 spoolsv.exe 222 PID 2296 set thread context of 2288 2296 explorer.exe 224 PID 1108 set thread context of 5080 1108 spoolsv.exe 225 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4816 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 4816 explorer.exe 2344 spoolsv.exe 2344 spoolsv.exe 3856 spoolsv.exe 3856 spoolsv.exe 376 spoolsv.exe 376 spoolsv.exe 3096 spoolsv.exe 3096 spoolsv.exe 4828 spoolsv.exe 4828 spoolsv.exe 3148 spoolsv.exe 3148 spoolsv.exe 1380 spoolsv.exe 1380 spoolsv.exe 1540 spoolsv.exe 1540 spoolsv.exe 1872 spoolsv.exe 1872 spoolsv.exe 1524 spoolsv.exe 1524 spoolsv.exe 1424 spoolsv.exe 1424 spoolsv.exe 2696 spoolsv.exe 2696 spoolsv.exe 3140 spoolsv.exe 3140 spoolsv.exe 2856 spoolsv.exe 2856 spoolsv.exe 4968 spoolsv.exe 4968 spoolsv.exe 4876 spoolsv.exe 4876 spoolsv.exe 4784 spoolsv.exe 4784 spoolsv.exe 1908 spoolsv.exe 1908 spoolsv.exe 1224 spoolsv.exe 1224 spoolsv.exe 948 spoolsv.exe 948 spoolsv.exe 2636 spoolsv.exe 2636 spoolsv.exe 4864 spoolsv.exe 4864 spoolsv.exe 3204 spoolsv.exe 3204 spoolsv.exe 1920 spoolsv.exe 1920 spoolsv.exe 648 spoolsv.exe 648 spoolsv.exe 4144 spoolsv.exe 4144 spoolsv.exe 3740 spoolsv.exe 3740 spoolsv.exe 2388 spoolsv.exe 2388 spoolsv.exe 2080 spoolsv.exe 2080 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 216 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 83 PID 4456 wrote to memory of 216 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 83 PID 4456 wrote to memory of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 4456 wrote to memory of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 4456 wrote to memory of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 4456 wrote to memory of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 4456 wrote to memory of 3008 4456 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 88 PID 3008 wrote to memory of 3840 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 89 PID 3008 wrote to memory of 3840 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 89 PID 3008 wrote to memory of 3840 3008 a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe 89 PID 3840 wrote to memory of 4816 3840 explorer.exe 97 PID 3840 wrote to memory of 4816 3840 explorer.exe 97 PID 3840 wrote to memory of 4816 3840 explorer.exe 97 PID 3840 wrote to memory of 4816 3840 explorer.exe 97 PID 3840 wrote to memory of 4816 3840 explorer.exe 97 PID 4816 wrote to memory of 4764 4816 explorer.exe 98 PID 4816 wrote to memory of 4764 4816 explorer.exe 98 PID 4816 wrote to memory of 4764 4816 explorer.exe 98 PID 4816 wrote to memory of 1212 4816 explorer.exe 99 PID 4816 wrote to memory of 1212 4816 explorer.exe 99 PID 4816 wrote to memory of 1212 4816 explorer.exe 99 PID 4816 wrote to memory of 320 4816 explorer.exe 100 PID 4816 wrote to memory of 320 4816 explorer.exe 100 PID 4816 wrote to memory of 320 4816 explorer.exe 100 PID 4816 wrote to memory of 4300 4816 explorer.exe 101 PID 4816 wrote to memory of 4300 4816 explorer.exe 101 PID 4816 wrote to memory of 4300 4816 explorer.exe 101 PID 4816 wrote to memory of 1664 4816 explorer.exe 102 PID 4816 wrote to memory of 1664 4816 explorer.exe 102 PID 4816 wrote to memory of 1664 4816 explorer.exe 102 PID 4816 wrote to memory of 460 4816 explorer.exe 103 PID 4816 wrote to memory of 460 4816 explorer.exe 103 PID 4816 wrote to memory of 460 4816 explorer.exe 103 PID 4816 wrote to memory of 5004 4816 explorer.exe 104 PID 4816 wrote to memory of 5004 4816 explorer.exe 104 PID 4816 wrote to memory of 5004 4816 explorer.exe 104 PID 4816 wrote to memory of 3016 4816 explorer.exe 105 PID 4816 wrote to memory of 3016 4816 explorer.exe 105 PID 4816 wrote to memory of 3016 4816 explorer.exe 105 PID 4816 wrote to memory of 3460 4816 explorer.exe 106 PID 4816 wrote to memory of 3460 4816 explorer.exe 106 PID 4816 wrote to memory of 3460 4816 explorer.exe 106 PID 4816 wrote to memory of 2396 4816 explorer.exe 107 PID 4816 wrote to memory of 2396 4816 explorer.exe 107 PID 4816 wrote to memory of 2396 4816 explorer.exe 107 PID 4816 wrote to memory of 4568 4816 explorer.exe 108 PID 4816 wrote to memory of 4568 4816 explorer.exe 108 PID 4816 wrote to memory of 4568 4816 explorer.exe 108 PID 4816 wrote to memory of 672 4816 explorer.exe 109 PID 4816 wrote to memory of 672 4816 explorer.exe 109 PID 4816 wrote to memory of 672 4816 explorer.exe 109 PID 4816 wrote to memory of 464 4816 explorer.exe 110 PID 4816 wrote to memory of 464 4816 explorer.exe 110 PID 4816 wrote to memory of 464 4816 explorer.exe 110 PID 4816 wrote to memory of 3952 4816 explorer.exe 111 PID 4816 wrote to memory of 3952 4816 explorer.exe 111 PID 4816 wrote to memory of 3952 4816 explorer.exe 111 PID 4816 wrote to memory of 4792 4816 explorer.exe 112 PID 4816 wrote to memory of 4792 4816 explorer.exe 112 PID 4816 wrote to memory of 4792 4816 explorer.exe 112 PID 4816 wrote to memory of 1912 4816 explorer.exe 113 PID 4816 wrote to memory of 1912 4816 explorer.exe 113 PID 4816 wrote to memory of 1912 4816 explorer.exe 113 PID 4816 wrote to memory of 4512 4816 explorer.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2316 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3904
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:376 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4072 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4956
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2420 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1384
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1424 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:664
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4968 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4344 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3652
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4876
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4784
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4592 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:224
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4864
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1920 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3364 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2872
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4144
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3740
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2388 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2056 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4984
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2080 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1356 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1660
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3012
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:544 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3860
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:632
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2288
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2708
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3448
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3320
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:808
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4004
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4732
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2464
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3184
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3852
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3684
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3116
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3596
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2724
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3948
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2556
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3592
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4756
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3600
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4920
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2580
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3028
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5104
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD51984d57b47fb7de2bfbd095b93092f4f
SHA1f902881e7089c4bd583655b81a9f19f1f135c129
SHA256defe52d49276d64fdf244114fefbed8003ad526a437a223fc0a811e1dc21f8d0
SHA5124562dad2bc72c9fcf3db30416a7b289fb5d5d9cc554da3ab11b36d34f3890b55e0572ecd5f949a407ebf0c97c45530a5f680d6546db7956e783ebbc944d97eed
-
Filesize
2.2MB
MD53efed47da3a338a162993ab00f7a02c5
SHA109f641d2d29caad8cc460d4c8377faf62b95eee8
SHA25600d63d2850506133f37bbe08cfd820b9b3e337b669f89f12c9baef42d47e00a0
SHA512b5e3473f0e553a9887df438e73574796003b33c44297ff1db3a516b08acac00ab40f55c96129caf129a50fbb5cf3a42221a559cb5faf32b78ec8606f7ef3a8a3