Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 08:26
Behavioral task
behavioral1
Sample
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8ba6f7d811802e8f2ec6e4c43b140c8
-
SHA1
2a3a8af881018dd70fa19b446ac49f0dcf5db4eb
-
SHA256
1f00a47860044b8693e60f503ca683c55c3d6110b4ae22133644179ffcf67a85
-
SHA512
f792c31bcf2a6f5ca67137997b79d6946a43c235ecf8887d08e25e420ea22fca285c6931d30650d258c970fd962ab5c779c99690d8d9e21143b26e93aba419bb
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwF
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 404 explorer.exe 2088 explorer.exe 4788 spoolsv.exe 3724 spoolsv.exe 4328 spoolsv.exe 1396 spoolsv.exe 2044 spoolsv.exe 4216 spoolsv.exe 884 spoolsv.exe 1800 spoolsv.exe 1624 spoolsv.exe 1568 spoolsv.exe 1468 spoolsv.exe 1664 spoolsv.exe 2824 spoolsv.exe 1868 spoolsv.exe 4308 spoolsv.exe 1984 spoolsv.exe 3368 spoolsv.exe 2068 spoolsv.exe 2708 spoolsv.exe 2132 spoolsv.exe 1476 spoolsv.exe 2280 spoolsv.exe 4032 spoolsv.exe 2960 spoolsv.exe 2208 spoolsv.exe 396 spoolsv.exe 1960 spoolsv.exe 3252 spoolsv.exe 2140 spoolsv.exe 4780 spoolsv.exe 772 spoolsv.exe 2328 explorer.exe 1924 spoolsv.exe 4604 spoolsv.exe 1052 spoolsv.exe 1276 spoolsv.exe 3084 spoolsv.exe 1400 spoolsv.exe 2996 spoolsv.exe 2596 explorer.exe 4060 spoolsv.exe 4460 spoolsv.exe 1356 spoolsv.exe 2304 spoolsv.exe 4748 spoolsv.exe 3356 spoolsv.exe 4952 spoolsv.exe 1244 explorer.exe 2476 spoolsv.exe 3528 spoolsv.exe 1240 spoolsv.exe 2300 spoolsv.exe 5084 spoolsv.exe 4704 spoolsv.exe 4764 explorer.exe 1676 spoolsv.exe 2544 spoolsv.exe 4620 spoolsv.exe 3108 spoolsv.exe 776 spoolsv.exe 2236 explorer.exe 4888 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 58 IoCs
Processes:
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 4328 set thread context of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 404 set thread context of 2088 404 explorer.exe explorer.exe PID 4788 set thread context of 772 4788 spoolsv.exe spoolsv.exe PID 3724 set thread context of 1924 3724 spoolsv.exe spoolsv.exe PID 4328 set thread context of 1052 4328 spoolsv.exe spoolsv.exe PID 1396 set thread context of 1276 1396 spoolsv.exe spoolsv.exe PID 2044 set thread context of 3084 2044 spoolsv.exe spoolsv.exe PID 4216 set thread context of 1400 4216 spoolsv.exe spoolsv.exe PID 884 set thread context of 2996 884 spoolsv.exe spoolsv.exe PID 1800 set thread context of 4460 1800 spoolsv.exe spoolsv.exe PID 1624 set thread context of 1356 1624 spoolsv.exe spoolsv.exe PID 1568 set thread context of 2304 1568 spoolsv.exe spoolsv.exe PID 1468 set thread context of 4748 1468 spoolsv.exe spoolsv.exe PID 1664 set thread context of 4952 1664 spoolsv.exe spoolsv.exe PID 2824 set thread context of 2476 2824 spoolsv.exe spoolsv.exe PID 1868 set thread context of 3528 1868 spoolsv.exe spoolsv.exe PID 4308 set thread context of 1240 4308 spoolsv.exe spoolsv.exe PID 1984 set thread context of 5084 1984 spoolsv.exe spoolsv.exe PID 3368 set thread context of 4704 3368 spoolsv.exe spoolsv.exe PID 2068 set thread context of 1676 2068 spoolsv.exe spoolsv.exe PID 2708 set thread context of 2544 2708 spoolsv.exe spoolsv.exe PID 2132 set thread context of 4620 2132 spoolsv.exe spoolsv.exe PID 1476 set thread context of 776 1476 spoolsv.exe spoolsv.exe PID 2280 set thread context of 4888 2280 spoolsv.exe spoolsv.exe PID 4032 set thread context of 4248 4032 spoolsv.exe spoolsv.exe PID 2960 set thread context of 4840 2960 spoolsv.exe spoolsv.exe PID 2208 set thread context of 4260 2208 spoolsv.exe spoolsv.exe PID 396 set thread context of 1108 396 spoolsv.exe spoolsv.exe PID 1960 set thread context of 2264 1960 spoolsv.exe spoolsv.exe PID 3252 set thread context of 2660 3252 spoolsv.exe spoolsv.exe PID 2140 set thread context of 1912 2140 spoolsv.exe spoolsv.exe PID 4780 set thread context of 3644 4780 spoolsv.exe spoolsv.exe PID 2328 set thread context of 1724 2328 explorer.exe explorer.exe PID 4604 set thread context of 3876 4604 spoolsv.exe spoolsv.exe PID 2596 set thread context of 628 2596 explorer.exe explorer.exe PID 4060 set thread context of 4280 4060 spoolsv.exe spoolsv.exe PID 3356 set thread context of 3560 3356 spoolsv.exe spoolsv.exe PID 1244 set thread context of 3696 1244 explorer.exe explorer.exe PID 2300 set thread context of 3712 2300 spoolsv.exe spoolsv.exe PID 4764 set thread context of 4884 4764 explorer.exe explorer.exe PID 3108 set thread context of 1952 3108 spoolsv.exe spoolsv.exe PID 2236 set thread context of 1532 2236 explorer.exe explorer.exe PID 4864 set thread context of 2892 4864 spoolsv.exe spoolsv.exe PID 2968 set thread context of 2524 2968 explorer.exe explorer.exe PID 228 set thread context of 3952 228 spoolsv.exe spoolsv.exe PID 2184 set thread context of 3376 2184 explorer.exe explorer.exe PID 2800 set thread context of 216 2800 spoolsv.exe spoolsv.exe PID 3704 set thread context of 2928 3704 spoolsv.exe spoolsv.exe PID 1000 set thread context of 60 1000 explorer.exe explorer.exe PID 1748 set thread context of 1336 1748 spoolsv.exe spoolsv.exe PID 4860 set thread context of 1100 4860 spoolsv.exe spoolsv.exe PID 1456 set thread context of 4276 1456 spoolsv.exe spoolsv.exe PID 1440 set thread context of 1224 1440 spoolsv.exe spoolsv.exe PID 3428 set thread context of 4940 3428 explorer.exe explorer.exe PID 640 set thread context of 1692 640 spoolsv.exe spoolsv.exe PID 1840 set thread context of 4320 1840 spoolsv.exe spoolsv.exe PID 1156 set thread context of 5016 1156 explorer.exe explorer.exe PID 2212 set thread context of 1524 2212 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exea8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exea8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exeexplorer.exepid process 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2088 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 2088 explorer.exe 772 spoolsv.exe 772 spoolsv.exe 1924 spoolsv.exe 1924 spoolsv.exe 1052 spoolsv.exe 1052 spoolsv.exe 1276 spoolsv.exe 1276 spoolsv.exe 3084 spoolsv.exe 3084 spoolsv.exe 1400 spoolsv.exe 1400 spoolsv.exe 2996 spoolsv.exe 2996 spoolsv.exe 4460 spoolsv.exe 4460 spoolsv.exe 1356 spoolsv.exe 1356 spoolsv.exe 2304 spoolsv.exe 2304 spoolsv.exe 4748 spoolsv.exe 4748 spoolsv.exe 4952 spoolsv.exe 4952 spoolsv.exe 2476 spoolsv.exe 2476 spoolsv.exe 3528 spoolsv.exe 3528 spoolsv.exe 1240 spoolsv.exe 1240 spoolsv.exe 5084 spoolsv.exe 5084 spoolsv.exe 4704 spoolsv.exe 4704 spoolsv.exe 1676 spoolsv.exe 1676 spoolsv.exe 2544 spoolsv.exe 2544 spoolsv.exe 4620 spoolsv.exe 4620 spoolsv.exe 776 spoolsv.exe 776 spoolsv.exe 4888 spoolsv.exe 4888 spoolsv.exe 4248 spoolsv.exe 4248 spoolsv.exe 4840 spoolsv.exe 4840 spoolsv.exe 4260 spoolsv.exe 4260 spoolsv.exe 1108 spoolsv.exe 1108 spoolsv.exe 2264 spoolsv.exe 2264 spoolsv.exe 2660 spoolsv.exe 2660 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exea8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 4328 wrote to memory of 4028 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe splwow64.exe PID 4328 wrote to memory of 4028 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe splwow64.exe PID 4328 wrote to memory of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 4328 wrote to memory of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 4328 wrote to memory of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 4328 wrote to memory of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 4328 wrote to memory of 1616 4328 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe PID 1616 wrote to memory of 404 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe explorer.exe PID 1616 wrote to memory of 404 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe explorer.exe PID 1616 wrote to memory of 404 1616 a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe explorer.exe PID 404 wrote to memory of 2088 404 explorer.exe explorer.exe PID 404 wrote to memory of 2088 404 explorer.exe explorer.exe PID 404 wrote to memory of 2088 404 explorer.exe explorer.exe PID 404 wrote to memory of 2088 404 explorer.exe explorer.exe PID 404 wrote to memory of 2088 404 explorer.exe explorer.exe PID 2088 wrote to memory of 4788 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4788 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4788 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 3724 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 3724 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 3724 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4328 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4328 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4328 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1396 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1396 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1396 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2044 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2044 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2044 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4216 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4216 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4216 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 884 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 884 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 884 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1800 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1800 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1800 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1624 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1624 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1624 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1568 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1568 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1568 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1468 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1468 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1468 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1664 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1664 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1664 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2824 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2824 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 2824 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1868 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1868 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1868 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4308 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4308 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 4308 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1984 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1984 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 1984 2088 explorer.exe spoolsv.exe PID 2088 wrote to memory of 3368 2088 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8ba6f7d811802e8f2ec6e4c43b140c8_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD59556c192c80a2fc8b77a80efa9fbb352
SHA19183cdacaca2700392316000ed014171f4ab1831
SHA25666737fff8cd0ad24c2a6716614ca1862743c790cdba0116a36987ae63caa6126
SHA51236475f3a0901ea579227c2892ffce46178c4700210e91e532c1715348f0a55dc64fa5606d66d23d561c357930e97926a101bcea4b553c3498361904a5a8f361f
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5f1ac01a28a98f90fe90315efb6314b13
SHA1449ef81cf660a25f06b26f4a956078fc632cea0d
SHA25640c01addba914dda1654b45ad87fe231f2517fafc2ab02c7963527cd02f0016c
SHA512205bdced15683ca793b48fc659fe8b7f1958b16670dce27d844551a9aa62f2f01e0110c4cafbe7eb163354f68c7459727dac8695f99afca68b9ca6025b01f695
-
memory/60-4794-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/216-4772-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/404-90-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/404-95-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/628-3820-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/772-2157-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/772-1986-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/776-2825-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/776-2979-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/884-1156-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1052-2079-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1240-2494-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1276-2093-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1356-2282-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1396-973-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1396-2087-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1400-2113-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1468-1557-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1476-1995-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1524-5170-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1532-4593-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1568-1359-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1616-79-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1616-77-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/1616-40-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1616-39-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1624-1358-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1664-1558-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1676-2658-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1692-5016-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1692-5012-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1724-3543-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1800-1357-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1868-1703-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1912-3126-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1912-3235-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1924-1996-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1952-4534-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1984-1903-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2044-1154-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2068-1905-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2088-804-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2088-94-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2132-1985-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2264-3013-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2280-2083-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2304-2294-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2476-2460-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2476-2464-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2524-4744-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2544-2668-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2660-3021-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2708-1984-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2824-1702-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2892-4735-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2996-2175-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3084-2102-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3368-1904-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3376-4764-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3528-2475-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3560-4181-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3560-4017-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3644-3423-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3644-3315-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3696-4114-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3712-4309-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3724-971-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3724-1991-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3876-3608-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3876-3731-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3952-4754-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4216-1155-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4248-2844-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-3100-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-2986-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4276-5079-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4276-4947-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4280-3827-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4280-3926-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4308-1704-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4320-5099-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4320-5207-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4328-972-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4328-0-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/4328-38-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/4328-43-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4328-36-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4328-2080-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4460-2270-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4620-2692-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4704-2649-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4748-2304-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4788-805-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4788-1981-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4840-2854-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4884-4318-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4888-2833-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4940-4964-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4952-2632-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5016-5109-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5084-2579-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB