Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 08:41
Behavioral task
behavioral1
Sample
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8c88b9b5d541b820d01cd1867479188
-
SHA1
b5a7f6e831c062d76c11ef2a09321274bbf56d11
-
SHA256
7cdeba81d496640b679c0fabab3b4b61a834340aa33c223503089be72dda5170
-
SHA512
f2fcec431379aa9c62ee82eb571f6a8dab04e37c8b9a4344c49e86fe990d873c86f8f5512104f374ebf378bc132ad4f984fbbda84760817dde3019e3471c28ac
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwC
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exepid process 1720 explorer.exe 3704 explorer.exe 3840 spoolsv.exe 3476 spoolsv.exe 2904 spoolsv.exe 1340 spoolsv.exe 4216 spoolsv.exe 4696 spoolsv.exe 3528 spoolsv.exe 4340 spoolsv.exe 4404 spoolsv.exe 4444 spoolsv.exe 2968 spoolsv.exe 2320 spoolsv.exe 4036 spoolsv.exe 3424 spoolsv.exe 4836 spoolsv.exe 4276 spoolsv.exe 1988 spoolsv.exe 4936 spoolsv.exe 3532 spoolsv.exe 1796 spoolsv.exe 3440 spoolsv.exe 1656 spoolsv.exe 3868 spoolsv.exe 2372 spoolsv.exe 2420 spoolsv.exe 396 spoolsv.exe 836 spoolsv.exe 3224 spoolsv.exe 1628 spoolsv.exe 776 spoolsv.exe 4152 spoolsv.exe 3672 spoolsv.exe 2808 explorer.exe 2952 spoolsv.exe 1912 spoolsv.exe 4864 spoolsv.exe 1080 spoolsv.exe 3132 spoolsv.exe 1036 spoolsv.exe 5068 spoolsv.exe 4300 spoolsv.exe 680 explorer.exe 856 spoolsv.exe 1548 spoolsv.exe 4064 spoolsv.exe 1472 spoolsv.exe 3140 spoolsv.exe 4468 explorer.exe 4856 spoolsv.exe 3260 spoolsv.exe 4532 spoolsv.exe 1124 spoolsv.exe 528 explorer.exe 5076 spoolsv.exe 5100 spoolsv.exe 4700 spoolsv.exe 940 spoolsv.exe 684 spoolsv.exe 2368 explorer.exe 1072 spoolsv.exe 1200 spoolsv.exe 3100 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 3496 set thread context of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 1720 set thread context of 3704 1720 explorer.exe explorer.exe PID 3840 set thread context of 3672 3840 spoolsv.exe spoolsv.exe PID 3476 set thread context of 2952 3476 spoolsv.exe spoolsv.exe PID 2904 set thread context of 1912 2904 spoolsv.exe spoolsv.exe PID 1340 set thread context of 4864 1340 spoolsv.exe spoolsv.exe PID 4216 set thread context of 1080 4216 spoolsv.exe spoolsv.exe PID 4696 set thread context of 3132 4696 spoolsv.exe spoolsv.exe PID 3528 set thread context of 5068 3528 spoolsv.exe spoolsv.exe PID 4340 set thread context of 4300 4340 spoolsv.exe spoolsv.exe PID 4404 set thread context of 856 4404 spoolsv.exe spoolsv.exe PID 4444 set thread context of 1548 4444 spoolsv.exe spoolsv.exe PID 2968 set thread context of 1472 2968 spoolsv.exe spoolsv.exe PID 2320 set thread context of 3140 2320 spoolsv.exe spoolsv.exe PID 4036 set thread context of 4856 4036 spoolsv.exe spoolsv.exe PID 3424 set thread context of 3260 3424 spoolsv.exe spoolsv.exe PID 4836 set thread context of 1124 4836 spoolsv.exe spoolsv.exe PID 4276 set thread context of 5076 4276 spoolsv.exe spoolsv.exe PID 1988 set thread context of 5100 1988 spoolsv.exe spoolsv.exe PID 4936 set thread context of 940 4936 spoolsv.exe spoolsv.exe PID 3532 set thread context of 684 3532 spoolsv.exe spoolsv.exe PID 1796 set thread context of 1072 1796 spoolsv.exe spoolsv.exe PID 3440 set thread context of 1200 3440 spoolsv.exe spoolsv.exe PID 1656 set thread context of 4744 1656 spoolsv.exe spoolsv.exe PID 3868 set thread context of 3088 3868 spoolsv.exe spoolsv.exe PID 2372 set thread context of 880 2372 spoolsv.exe spoolsv.exe PID 2420 set thread context of 4904 2420 spoolsv.exe spoolsv.exe PID 396 set thread context of 1284 396 spoolsv.exe spoolsv.exe PID 836 set thread context of 4536 836 spoolsv.exe spoolsv.exe PID 3224 set thread context of 1396 3224 spoolsv.exe spoolsv.exe PID 1628 set thread context of 1632 1628 spoolsv.exe spoolsv.exe PID 776 set thread context of 3976 776 spoolsv.exe spoolsv.exe PID 4152 set thread context of 3604 4152 spoolsv.exe spoolsv.exe PID 2808 set thread context of 988 2808 explorer.exe explorer.exe PID 1036 set thread context of 3984 1036 spoolsv.exe spoolsv.exe PID 680 set thread context of 624 680 explorer.exe explorer.exe PID 4064 set thread context of 5060 4064 spoolsv.exe spoolsv.exe PID 4468 set thread context of 3028 4468 explorer.exe explorer.exe PID 4532 set thread context of 532 4532 spoolsv.exe spoolsv.exe PID 528 set thread context of 2900 528 explorer.exe explorer.exe PID 4700 set thread context of 3876 4700 spoolsv.exe spoolsv.exe PID 2368 set thread context of 4412 2368 explorer.exe explorer.exe PID 3100 set thread context of 4436 3100 spoolsv.exe spoolsv.exe PID 4648 set thread context of 5000 4648 explorer.exe explorer.exe PID 448 set thread context of 4344 448 spoolsv.exe spoolsv.exe PID 4624 set thread context of 1960 4624 explorer.exe explorer.exe PID 1616 set thread context of 512 1616 spoolsv.exe spoolsv.exe PID 2316 set thread context of 4988 2316 explorer.exe explorer.exe PID 2000 set thread context of 5020 2000 spoolsv.exe spoolsv.exe PID 5028 set thread context of 3348 5028 spoolsv.exe spoolsv.exe PID 3980 set thread context of 1424 3980 spoolsv.exe spoolsv.exe PID 4880 set thread context of 1652 4880 spoolsv.exe spoolsv.exe PID 4688 set thread context of 4876 4688 explorer.exe explorer.exe PID 2840 set thread context of 832 2840 spoolsv.exe spoolsv.exe PID 332 set thread context of 2644 332 spoolsv.exe spoolsv.exe PID 4520 set thread context of 4916 4520 explorer.exe explorer.exe PID 4596 set thread context of 456 4596 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
explorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exea8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exeexplorer.exepid process 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3704 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3672 spoolsv.exe 3672 spoolsv.exe 2952 spoolsv.exe 2952 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe 4864 spoolsv.exe 4864 spoolsv.exe 1080 spoolsv.exe 1080 spoolsv.exe 3132 spoolsv.exe 3132 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 4300 spoolsv.exe 4300 spoolsv.exe 856 spoolsv.exe 856 spoolsv.exe 1548 spoolsv.exe 1548 spoolsv.exe 1472 spoolsv.exe 1472 spoolsv.exe 3140 spoolsv.exe 3140 spoolsv.exe 4856 spoolsv.exe 4856 spoolsv.exe 3260 spoolsv.exe 3260 spoolsv.exe 1124 spoolsv.exe 1124 spoolsv.exe 5076 spoolsv.exe 5076 spoolsv.exe 5100 spoolsv.exe 5100 spoolsv.exe 940 spoolsv.exe 940 spoolsv.exe 684 spoolsv.exe 684 spoolsv.exe 1072 spoolsv.exe 1072 spoolsv.exe 1200 spoolsv.exe 1200 spoolsv.exe 4744 spoolsv.exe 4744 spoolsv.exe 3088 spoolsv.exe 3088 spoolsv.exe 880 spoolsv.exe 880 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 1284 spoolsv.exe 1284 spoolsv.exe 4536 spoolsv.exe 4536 spoolsv.exe 1396 spoolsv.exe 1396 spoolsv.exe 1632 spoolsv.exe 1632 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exea8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 3496 wrote to memory of 1904 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe splwow64.exe PID 3496 wrote to memory of 1904 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe splwow64.exe PID 3496 wrote to memory of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 3496 wrote to memory of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 3496 wrote to memory of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 3496 wrote to memory of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 3496 wrote to memory of 4608 3496 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe PID 4608 wrote to memory of 1720 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe explorer.exe PID 4608 wrote to memory of 1720 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe explorer.exe PID 4608 wrote to memory of 1720 4608 a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe explorer.exe PID 1720 wrote to memory of 3704 1720 explorer.exe explorer.exe PID 1720 wrote to memory of 3704 1720 explorer.exe explorer.exe PID 1720 wrote to memory of 3704 1720 explorer.exe explorer.exe PID 1720 wrote to memory of 3704 1720 explorer.exe explorer.exe PID 1720 wrote to memory of 3704 1720 explorer.exe explorer.exe PID 3704 wrote to memory of 3840 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3840 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3840 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3476 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3476 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3476 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2904 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2904 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2904 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 1340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 1340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 1340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4216 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4216 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4216 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4696 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4696 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4696 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3528 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3528 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3528 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4340 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4404 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4404 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4404 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4444 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4444 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4444 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2968 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2968 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2968 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2320 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2320 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 2320 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4036 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4036 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4036 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3424 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3424 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 3424 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4836 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4836 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4836 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4276 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4276 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 4276 3704 explorer.exe spoolsv.exe PID 3704 wrote to memory of 1988 3704 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8c88b9b5d541b820d01cd1867479188_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5f2b71be74320fdd0fd459a467954ec69
SHA11158c8a5843510a57834be14d89f086421aaa485
SHA256931516a13732e882643ba4c915819d4967130746856ba970de3c45e36e0a7751
SHA512104c68410578abfb9f6166c35745f9c504d25605eb591c544c50df026caeb1964622f17fee0b3b6701e7f05740b2921b83538c4b5881e1ebf803be2e3afbaba7
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5c14ae75097b8b50b9066c8be82444d51
SHA1befdc27788f3f1936b3ccc8a67b8e0fa05b7a407
SHA25622d96d5c784159867a65e82bb00e840a6fe4ef6a38d069366e432bb80c9b1943
SHA512f5d827a281fd7a82b3412e9c3efa21448569604f1b981615837359c2a13d1ee6b051a4a33124770d8d77e949cba634ae8251a76cf00ce8921d49302c0a7a830d
-
memory/456-5231-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/512-4616-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/512-4620-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/532-4070-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-3688-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/684-2688-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/684-2844-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/832-4869-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/832-4866-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/856-2165-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/880-2870-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/940-2621-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/988-3476-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/988-3473-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1080-1993-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1124-2660-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1124-2501-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1200-2704-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1200-2707-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1284-2901-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1340-923-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1340-1980-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1396-3119-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1396-3027-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1424-4751-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1472-2249-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1548-2174-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1652-4850-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1652-4982-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1656-1972-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1720-70-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1720-65-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1796-1950-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1960-4608-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1988-1789-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2320-1453-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2644-5074-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2644-5213-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2900-4079-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2904-1969-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2904-922-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2952-1963-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2952-1958-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2968-1452-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3028-3904-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3088-2859-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3088-3001-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3132-2004-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3140-2477-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3140-2334-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3260-2352-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3348-4741-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3424-1598-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3440-1957-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3476-921-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3476-1961-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3496-0-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/3496-33-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3496-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3496-28-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/3528-1086-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3532-1949-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3604-3465-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-2136-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-1951-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3704-69-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3704-809-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3840-1947-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3840-810-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3876-4233-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3976-3147-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3976-3260-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3984-3676-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4036-1597-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4216-1084-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4276-1788-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4300-2290-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4300-2154-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4340-1277-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4344-4598-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4404-1278-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4412-4244-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4412-4241-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4436-4486-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4436-4572-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4444-1279-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4536-2968-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4536-2965-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-59-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-57-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4696-1085-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4836-1599-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4856-2342-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4864-1984-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4876-4859-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4904-2879-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4904-2884-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4916-5085-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4916-5081-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4936-1790-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4988-4630-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5000-4499-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5020-4637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-3972-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-3895-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5068-2101-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5076-2508-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5100-2518-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB