Analysis
-
max time kernel
132s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 07:44
Behavioral task
behavioral1
Sample
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8944632a1c4bec9b3c05f8b62ad7116
-
SHA1
d55225b244d6e4d8dc6ed02d2da11bb604273b51
-
SHA256
950a53df6357644a06e369978a38dde297ae73e1b9004eaf61d0e420a87e9c39
-
SHA512
c7e78c472a7bec4367f423a1c0281fc4dba9c800785a49a139ba1c6b483e9bd2e3e2c295f9d3afeb0d1f6804cad775cddc464ea81d1b2b49814c41b6e9e179e8
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwc
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
Processes:
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 4120 explorer.exe 1516 explorer.exe 2940 spoolsv.exe 3108 spoolsv.exe 3328 spoolsv.exe 4384 spoolsv.exe 4864 spoolsv.exe 3604 spoolsv.exe 3708 spoolsv.exe 3360 spoolsv.exe 3668 spoolsv.exe 3092 spoolsv.exe 4952 spoolsv.exe 1440 spoolsv.exe 4040 spoolsv.exe 3188 spoolsv.exe 4268 spoolsv.exe 2100 spoolsv.exe 4552 spoolsv.exe 4224 spoolsv.exe 3788 spoolsv.exe 4084 spoolsv.exe 3200 spoolsv.exe 1540 spoolsv.exe 4912 spoolsv.exe 2264 spoolsv.exe 2148 spoolsv.exe 4416 spoolsv.exe 2980 spoolsv.exe 2352 spoolsv.exe 3964 spoolsv.exe 3944 spoolsv.exe 5008 spoolsv.exe 1336 spoolsv.exe 4240 spoolsv.exe 492 explorer.exe 4348 spoolsv.exe 2316 spoolsv.exe 1500 spoolsv.exe 404 spoolsv.exe 4000 spoolsv.exe 3792 spoolsv.exe 1676 explorer.exe 3028 spoolsv.exe 4884 spoolsv.exe 1668 spoolsv.exe 3472 spoolsv.exe 3676 spoolsv.exe 4192 explorer.exe 3640 spoolsv.exe 4980 spoolsv.exe 372 spoolsv.exe 3496 spoolsv.exe 3464 spoolsv.exe 3100 spoolsv.exe 1920 explorer.exe 1804 spoolsv.exe 4308 spoolsv.exe 752 spoolsv.exe 3376 spoolsv.exe 4100 spoolsv.exe 60 spoolsv.exe 2400 explorer.exe 3124 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 44 IoCs
Processes:
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 2596 set thread context of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 4120 set thread context of 1516 4120 explorer.exe explorer.exe PID 2940 set thread context of 4240 2940 spoolsv.exe spoolsv.exe PID 3108 set thread context of 4348 3108 spoolsv.exe spoolsv.exe PID 3328 set thread context of 1500 3328 spoolsv.exe spoolsv.exe PID 4384 set thread context of 404 4384 spoolsv.exe spoolsv.exe PID 4864 set thread context of 4000 4864 spoolsv.exe spoolsv.exe PID 3604 set thread context of 3792 3604 spoolsv.exe spoolsv.exe PID 3708 set thread context of 4884 3708 spoolsv.exe spoolsv.exe PID 3360 set thread context of 1668 3360 spoolsv.exe spoolsv.exe PID 3668 set thread context of 3472 3668 spoolsv.exe spoolsv.exe PID 3092 set thread context of 3676 3092 spoolsv.exe spoolsv.exe PID 4952 set thread context of 3640 4952 spoolsv.exe spoolsv.exe PID 1440 set thread context of 372 1440 spoolsv.exe spoolsv.exe PID 4040 set thread context of 3496 4040 spoolsv.exe spoolsv.exe PID 3188 set thread context of 3464 3188 spoolsv.exe spoolsv.exe PID 4268 set thread context of 3100 4268 spoolsv.exe spoolsv.exe PID 2100 set thread context of 1804 2100 spoolsv.exe spoolsv.exe PID 4552 set thread context of 752 4552 spoolsv.exe spoolsv.exe PID 4224 set thread context of 3376 4224 spoolsv.exe spoolsv.exe PID 3788 set thread context of 4100 3788 spoolsv.exe spoolsv.exe PID 4084 set thread context of 60 4084 spoolsv.exe spoolsv.exe PID 3200 set thread context of 4720 3200 spoolsv.exe spoolsv.exe PID 1540 set thread context of 4120 1540 spoolsv.exe spoolsv.exe PID 4912 set thread context of 5036 4912 spoolsv.exe spoolsv.exe PID 2264 set thread context of 1208 2264 spoolsv.exe spoolsv.exe PID 2148 set thread context of 332 2148 spoolsv.exe spoolsv.exe PID 4416 set thread context of 556 4416 spoolsv.exe spoolsv.exe PID 2980 set thread context of 4856 2980 spoolsv.exe spoolsv.exe PID 2352 set thread context of 932 2352 spoolsv.exe spoolsv.exe PID 3964 set thread context of 3600 3964 spoolsv.exe spoolsv.exe PID 3944 set thread context of 1512 3944 spoolsv.exe spoolsv.exe PID 5008 set thread context of 3940 5008 spoolsv.exe spoolsv.exe PID 1336 set thread context of 3976 1336 spoolsv.exe spoolsv.exe PID 492 set thread context of 1092 492 explorer.exe explorer.exe PID 2316 set thread context of 4152 2316 spoolsv.exe spoolsv.exe PID 1676 set thread context of 2964 1676 explorer.exe explorer.exe PID 3028 set thread context of 4452 3028 spoolsv.exe spoolsv.exe PID 4192 set thread context of 4464 4192 explorer.exe explorer.exe PID 4980 set thread context of 5024 4980 spoolsv.exe spoolsv.exe PID 1920 set thread context of 728 1920 explorer.exe explorer.exe PID 4308 set thread context of 220 4308 spoolsv.exe spoolsv.exe PID 2400 set thread context of 984 2400 explorer.exe explorer.exe PID 3124 set thread context of 4272 3124 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exea8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exea8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exeexplorer.exepid process 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1516 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 4240 spoolsv.exe 4240 spoolsv.exe 4348 spoolsv.exe 4348 spoolsv.exe 1500 spoolsv.exe 1500 spoolsv.exe 404 spoolsv.exe 404 spoolsv.exe 4000 spoolsv.exe 4000 spoolsv.exe 3792 spoolsv.exe 3792 spoolsv.exe 4884 spoolsv.exe 4884 spoolsv.exe 1668 spoolsv.exe 1668 spoolsv.exe 3472 spoolsv.exe 3472 spoolsv.exe 3676 spoolsv.exe 3676 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 372 spoolsv.exe 372 spoolsv.exe 3496 spoolsv.exe 3496 spoolsv.exe 3464 spoolsv.exe 3464 spoolsv.exe 3100 spoolsv.exe 3100 spoolsv.exe 1804 spoolsv.exe 1804 spoolsv.exe 752 spoolsv.exe 752 spoolsv.exe 3376 spoolsv.exe 3376 spoolsv.exe 4100 spoolsv.exe 4100 spoolsv.exe 60 spoolsv.exe 60 spoolsv.exe 4720 spoolsv.exe 4720 spoolsv.exe 4120 spoolsv.exe 4120 spoolsv.exe 5036 spoolsv.exe 5036 spoolsv.exe 1208 spoolsv.exe 1208 spoolsv.exe 332 spoolsv.exe 332 spoolsv.exe 556 spoolsv.exe 556 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 932 spoolsv.exe 932 spoolsv.exe 3600 spoolsv.exe 3600 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exea8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 2596 wrote to memory of 724 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe splwow64.exe PID 2596 wrote to memory of 724 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe splwow64.exe PID 2596 wrote to memory of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 2596 wrote to memory of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 2596 wrote to memory of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 2596 wrote to memory of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 2596 wrote to memory of 2756 2596 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe PID 2756 wrote to memory of 4120 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe explorer.exe PID 2756 wrote to memory of 4120 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe explorer.exe PID 2756 wrote to memory of 4120 2756 a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe explorer.exe PID 4120 wrote to memory of 1516 4120 explorer.exe explorer.exe PID 4120 wrote to memory of 1516 4120 explorer.exe explorer.exe PID 4120 wrote to memory of 1516 4120 explorer.exe explorer.exe PID 4120 wrote to memory of 1516 4120 explorer.exe explorer.exe PID 4120 wrote to memory of 1516 4120 explorer.exe explorer.exe PID 1516 wrote to memory of 2940 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 2940 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 2940 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3108 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3108 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3108 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3328 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3328 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3328 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4384 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4384 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4384 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4864 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4864 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4864 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3604 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3604 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3604 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3708 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3708 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3708 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3360 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3360 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3360 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3668 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3668 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3668 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3092 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3092 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3092 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4952 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4952 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4952 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 1440 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 1440 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 1440 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4040 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4040 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4040 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3188 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3188 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 3188 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4268 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4268 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4268 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 2100 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 2100 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 2100 1516 explorer.exe spoolsv.exe PID 1516 wrote to memory of 4552 1516 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8944632a1c4bec9b3c05f8b62ad7116_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5c0c0ee9a61ca213ef508d0650d7dd9c9
SHA16d4991f5b4e950972b6725eda302ce4ee8678288
SHA256229eae1c86f654bcd1be36ba84f9df6aae94b61b3a0bc5b04c21ce3f7bb95cfc
SHA5126978dde96d581ff1be238541f04f9ce83406c01012bc381297823a63c9f6faa49f9b983d455c8c75702bf2c11a7c73273c658498d6a26767d25946649bd9a6b7
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD52e7857cc8928644e47181b43f12fbc9b
SHA1f9088d39bca7e6a174ab5b829e27f89f2ec5467e
SHA256ec4765784efd2db25ce6a21e38e5bab00c1ae4da4c77d6334cd6797d66687a15
SHA5121b3f162c1443411212ddceed77a61779d0725c8b7eb151d507021aa667466cf5131e8cc7cc3471597ecd4d24224be35714ac7e33e5d4929cbe7bd25facc89253
-
memory/60-3017-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/220-5201-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/372-2697-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/372-2702-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/404-2328-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/556-3287-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/636-5833-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/728-4984-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/752-2905-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/984-5303-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1040-6256-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1060-6238-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1092-3973-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1208-3409-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1208-3202-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1440-1694-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1476-6049-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1500-2318-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1512-3459-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1512-3593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1516-940-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1516-85-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1540-2208-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1656-5773-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1656-5637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1668-2521-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1668-2516-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1804-2820-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2044-5851-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2100-1931-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2116-5989-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2116-5823-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2212-5929-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2212-5933-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2596-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2596-47-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2596-0-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/2596-43-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/2756-74-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2756-72-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2756-46-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2756-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2800-6261-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2940-2201-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2940-941-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2964-4340-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3092-1545-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3100-2813-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3108-1152-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3108-2212-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3188-1929-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3200-2199-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3220-6219-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3328-2310-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3328-1153-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3360-1543-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3376-2915-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3464-2719-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3472-2529-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3496-2709-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3604-1351-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3640-2624-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3668-1544-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3676-2614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3708-1352-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3788-2110-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3792-2417-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3792-2595-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3808-6253-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3940-3541-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3976-3819-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4000-2341-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4040-1695-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4084-2198-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4100-2927-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4120-80-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4120-86-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4152-4043-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4152-4167-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4200-5942-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4224-2109-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4240-2200-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4240-2398-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4268-1930-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4272-5450-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-6035-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4296-6039-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4336-5725-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4348-2213-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4348-2209-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4384-1154-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4452-4542-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4452-4439-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4464-4676-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4552-2108-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4720-3099-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4720-3094-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4856-3299-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4856-3294-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4864-1350-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4884-2504-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4884-2509-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4912-2317-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4952-1693-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5024-4757-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5036-3158-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5108-6058-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB