Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 08:44
Behavioral task
behavioral1
Sample
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8caa41343c8b6deaf5335580130e784
-
SHA1
fee61c22dc205ceefc2542dfb33a4a22acd927f1
-
SHA256
cb985ed705166e181f05249232eaf4dbaf48bf2b25fa1425b1c9ebe20b4319f3
-
SHA512
a62d3fb9df46203575e8f15ce2ee5468429fbb568f4043f177625d44a290b5c94483fcc58fead864235da06583e7aa85d15fbab88569e6e03db89d6235dcc3d2
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwF
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4648 explorer.exe 1600 explorer.exe 4756 spoolsv.exe 3996 spoolsv.exe 4400 spoolsv.exe 1556 spoolsv.exe 60 spoolsv.exe 2168 spoolsv.exe 4416 spoolsv.exe 2068 spoolsv.exe 3880 spoolsv.exe 4436 spoolsv.exe 3176 spoolsv.exe 2020 spoolsv.exe 4512 spoolsv.exe 3516 spoolsv.exe 3820 spoolsv.exe 1588 spoolsv.exe 1836 spoolsv.exe 2592 spoolsv.exe 3568 spoolsv.exe 724 spoolsv.exe 4248 spoolsv.exe 4568 spoolsv.exe 3116 spoolsv.exe 3908 spoolsv.exe 1680 spoolsv.exe 2372 spoolsv.exe 4196 spoolsv.exe 3652 spoolsv.exe 4432 spoolsv.exe 920 spoolsv.exe 2972 spoolsv.exe 4560 explorer.exe 4648 spoolsv.exe 1596 spoolsv.exe 4356 spoolsv.exe 4336 spoolsv.exe 2212 spoolsv.exe 2612 explorer.exe 2044 spoolsv.exe 3696 spoolsv.exe 4216 spoolsv.exe 4428 spoolsv.exe 2648 spoolsv.exe 4792 explorer.exe 1336 spoolsv.exe 1044 spoolsv.exe 3876 spoolsv.exe 4408 spoolsv.exe 1848 spoolsv.exe 3904 spoolsv.exe 4748 explorer.exe 4772 spoolsv.exe 4844 spoolsv.exe 1912 spoolsv.exe 2672 spoolsv.exe 5016 spoolsv.exe 4332 spoolsv.exe 1240 explorer.exe 3496 spoolsv.exe 4964 spoolsv.exe 744 spoolsv.exe 1284 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 936 set thread context of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 4648 set thread context of 1600 4648 explorer.exe explorer.exe PID 4756 set thread context of 2972 4756 spoolsv.exe spoolsv.exe PID 3996 set thread context of 4648 3996 spoolsv.exe spoolsv.exe PID 4400 set thread context of 1596 4400 spoolsv.exe spoolsv.exe PID 1556 set thread context of 4336 1556 spoolsv.exe spoolsv.exe PID 60 set thread context of 2212 60 spoolsv.exe spoolsv.exe PID 2168 set thread context of 2044 2168 spoolsv.exe spoolsv.exe PID 4416 set thread context of 3696 4416 spoolsv.exe spoolsv.exe PID 2068 set thread context of 4428 2068 spoolsv.exe spoolsv.exe PID 3880 set thread context of 2648 3880 spoolsv.exe spoolsv.exe PID 4436 set thread context of 1336 4436 spoolsv.exe spoolsv.exe PID 3176 set thread context of 1044 3176 spoolsv.exe spoolsv.exe PID 2020 set thread context of 3876 2020 spoolsv.exe spoolsv.exe PID 4512 set thread context of 1848 4512 spoolsv.exe spoolsv.exe PID 3516 set thread context of 3904 3516 spoolsv.exe spoolsv.exe PID 3820 set thread context of 4772 3820 spoolsv.exe spoolsv.exe PID 1588 set thread context of 4844 1588 spoolsv.exe spoolsv.exe PID 1836 set thread context of 1912 1836 spoolsv.exe spoolsv.exe PID 2592 set thread context of 5016 2592 spoolsv.exe spoolsv.exe PID 3568 set thread context of 4332 3568 spoolsv.exe spoolsv.exe PID 724 set thread context of 3496 724 spoolsv.exe spoolsv.exe PID 4248 set thread context of 744 4248 spoolsv.exe spoolsv.exe PID 4568 set thread context of 1284 4568 spoolsv.exe spoolsv.exe PID 3116 set thread context of 1060 3116 spoolsv.exe spoolsv.exe PID 3908 set thread context of 2988 3908 spoolsv.exe spoolsv.exe PID 1680 set thread context of 2180 1680 spoolsv.exe spoolsv.exe PID 2372 set thread context of 1560 2372 spoolsv.exe spoolsv.exe PID 4196 set thread context of 4920 4196 spoolsv.exe spoolsv.exe PID 3652 set thread context of 740 3652 spoolsv.exe spoolsv.exe PID 4432 set thread context of 4288 4432 spoolsv.exe spoolsv.exe PID 920 set thread context of 2176 920 spoolsv.exe spoolsv.exe PID 4560 set thread context of 4312 4560 explorer.exe explorer.exe PID 4356 set thread context of 3064 4356 spoolsv.exe spoolsv.exe PID 2612 set thread context of 2028 2612 explorer.exe explorer.exe PID 4216 set thread context of 2760 4216 spoolsv.exe spoolsv.exe PID 4792 set thread context of 4200 4792 explorer.exe explorer.exe PID 4408 set thread context of 2088 4408 spoolsv.exe spoolsv.exe PID 4748 set thread context of 1200 4748 explorer.exe explorer.exe PID 2672 set thread context of 636 2672 spoolsv.exe spoolsv.exe PID 1240 set thread context of 1960 1240 explorer.exe explorer.exe PID 4964 set thread context of 1464 4964 spoolsv.exe spoolsv.exe PID 3088 set thread context of 5060 3088 spoolsv.exe spoolsv.exe PID 2284 set thread context of 1036 2284 explorer.exe explorer.exe PID 4092 set thread context of 1916 4092 spoolsv.exe spoolsv.exe PID 2684 set thread context of 2528 2684 explorer.exe explorer.exe PID 3220 set thread context of 3780 3220 spoolsv.exe spoolsv.exe PID 4644 set thread context of 4488 4644 spoolsv.exe spoolsv.exe PID 4836 set thread context of 3120 4836 spoolsv.exe spoolsv.exe PID 4184 set thread context of 2556 4184 explorer.exe explorer.exe PID 2516 set thread context of 3556 2516 spoolsv.exe spoolsv.exe PID 2024 set thread context of 4068 2024 explorer.exe explorer.exe PID 4776 set thread context of 2820 4776 spoolsv.exe spoolsv.exe PID 4980 set thread context of 1948 4980 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exea8caa41343c8b6deaf5335580130e784_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exea8caa41343c8b6deaf5335580130e784_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exeexplorer.exepid process 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1600 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe 2972 spoolsv.exe 2972 spoolsv.exe 4648 spoolsv.exe 4648 spoolsv.exe 1596 spoolsv.exe 1596 spoolsv.exe 4336 spoolsv.exe 4336 spoolsv.exe 2212 spoolsv.exe 2212 spoolsv.exe 2044 spoolsv.exe 2044 spoolsv.exe 3696 spoolsv.exe 3696 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 2648 spoolsv.exe 2648 spoolsv.exe 1336 spoolsv.exe 1336 spoolsv.exe 1044 spoolsv.exe 1044 spoolsv.exe 3876 spoolsv.exe 3876 spoolsv.exe 1848 spoolsv.exe 1848 spoolsv.exe 3904 spoolsv.exe 3904 spoolsv.exe 4772 spoolsv.exe 4772 spoolsv.exe 4844 spoolsv.exe 4844 spoolsv.exe 1912 spoolsv.exe 1912 spoolsv.exe 5016 spoolsv.exe 5016 spoolsv.exe 4332 spoolsv.exe 4332 spoolsv.exe 3496 spoolsv.exe 3496 spoolsv.exe 744 spoolsv.exe 744 spoolsv.exe 1284 spoolsv.exe 1284 spoolsv.exe 1060 spoolsv.exe 1060 spoolsv.exe 2988 spoolsv.exe 2988 spoolsv.exe 2180 spoolsv.exe 2180 spoolsv.exe 1560 spoolsv.exe 1560 spoolsv.exe 4920 spoolsv.exe 4920 spoolsv.exe 740 spoolsv.exe 740 spoolsv.exe 4288 spoolsv.exe 4288 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exea8caa41343c8b6deaf5335580130e784_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 936 wrote to memory of 1612 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe splwow64.exe PID 936 wrote to memory of 1612 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe splwow64.exe PID 936 wrote to memory of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 936 wrote to memory of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 936 wrote to memory of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 936 wrote to memory of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 936 wrote to memory of 4820 936 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe PID 4820 wrote to memory of 4648 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe explorer.exe PID 4820 wrote to memory of 4648 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe explorer.exe PID 4820 wrote to memory of 4648 4820 a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe explorer.exe PID 4648 wrote to memory of 1600 4648 explorer.exe explorer.exe PID 4648 wrote to memory of 1600 4648 explorer.exe explorer.exe PID 4648 wrote to memory of 1600 4648 explorer.exe explorer.exe PID 4648 wrote to memory of 1600 4648 explorer.exe explorer.exe PID 4648 wrote to memory of 1600 4648 explorer.exe explorer.exe PID 1600 wrote to memory of 4756 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4756 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4756 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3996 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3996 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3996 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4400 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4400 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4400 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1556 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1556 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1556 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 60 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 60 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 60 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2168 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2168 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2168 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4416 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4416 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4416 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2068 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2068 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2068 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3880 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3880 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3880 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4436 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4436 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4436 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3176 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3176 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3176 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2020 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2020 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 2020 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4512 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4512 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 4512 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3516 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3516 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3516 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3820 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3820 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 3820 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1588 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1588 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1588 1600 explorer.exe spoolsv.exe PID 1600 wrote to memory of 1836 1600 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8caa41343c8b6deaf5335580130e784_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD53b30ddbaf31e9efd526938e4f6187478
SHA17feb2265296384a02b828759246206cdc06775bd
SHA2568fba6684b02aeac7196ac8e7dc6ce929756a5c0a69df5acda174ee2df8dd6ee2
SHA51208b3ca935eec0e1c273d36dabfccdaf12bd9d90cac38a437fe389e3dc4bc159f09a1d992391562c789769e688760ceae37ceb80dd8235c69766c83561923fc5f
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD599235691758a66b9869e864989fff67c
SHA1ec9f4964cd9d9bee1faf267429e274322819a73b
SHA2569be8d1265b8d996aceb522a0f368bba0a64078529850b8d033b10b2a6a1e4292
SHA51219332269ea6d91dfbd156f2d473e0b9e78e2b9ba0056c28577e9c1c3c6afcc36e3882df7d98365e15cc2e4601e26b827add720f34fbdabc2dde781178b4918a1
-
memory/60-1218-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/636-4255-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/636-4323-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/724-1958-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/740-3150-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/744-2810-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/744-2813-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/936-33-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/936-37-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/936-0-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/936-31-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1036-4562-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1044-2362-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1060-2836-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1200-4050-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1200-4053-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1284-2827-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1336-2353-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1464-4352-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1556-1027-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1588-1876-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1596-1981-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1600-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1600-843-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1836-1877-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1848-2474-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1912-2627-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1912-2631-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1916-4649-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-5234-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1948-5237-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1960-4346-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2020-1512-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2028-3552-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2044-2181-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2068-1366-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2088-3980-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2168-1219-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2176-3472-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-3002-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2180-3005-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2212-2326-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2212-2172-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2528-4658-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2592-1878-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2648-2510-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2648-2345-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2760-3720-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2760-3854-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2820-5224-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2972-2121-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2972-1959-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2988-3126-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2988-2994-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3064-3489-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3116-2063-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3120-4984-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3176-1511-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3452-5472-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3496-2741-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3516-1707-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3556-5202-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3568-1957-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3696-2193-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3780-4742-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3820-1708-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3876-2375-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3880-1372-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3904-2543-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3996-1970-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3996-1025-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4068-5211-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4068-5214-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4200-3791-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4248-1967-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4288-3158-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4312-3424-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4332-2732-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4332-2891-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4336-2064-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4336-2067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4400-1978-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4400-1026-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4416-1220-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4428-2282-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4436-1510-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4488-4973-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4488-5108-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4512-1706-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4568-1980-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4648-69-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4648-1968-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4648-74-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4756-1960-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4756-844-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4772-2552-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4820-62-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/4820-63-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4820-36-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4820-34-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4844-2564-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4920-3021-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5032-5379-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-4725-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5060-4554-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB