Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 09:31
Behavioral task
behavioral1
Sample
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
a8fa3c57ab33dd66ba742d49a0e9cd7b
-
SHA1
1ac207291937059c22d65b3264460ffec694debd
-
SHA256
d8ea3aa3bda006bb7ead336e77a992f59b9fdb81466a4f1eda0c2958c277615f
-
SHA512
3d8450cea05047c9eb1e7eccc5104134d33caf8141f50874a2b5d42f5e5404ed3fdfd83c1c71ded0e818eee75bc47b26db6b670b5c9c028a42ba0274243c70ff
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwE
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 4260 explorer.exe 1632 explorer.exe 1444 spoolsv.exe 832 spoolsv.exe 2288 spoolsv.exe 4948 spoolsv.exe 4368 spoolsv.exe 2996 spoolsv.exe 2816 spoolsv.exe 1796 spoolsv.exe 3000 spoolsv.exe 4156 spoolsv.exe 5064 spoolsv.exe 1884 spoolsv.exe 4140 spoolsv.exe 3160 spoolsv.exe 3436 spoolsv.exe 1168 spoolsv.exe 2356 spoolsv.exe 1032 spoolsv.exe 3924 spoolsv.exe 3496 spoolsv.exe 3504 spoolsv.exe 5092 spoolsv.exe 2700 spoolsv.exe 932 spoolsv.exe 2824 spoolsv.exe 1412 spoolsv.exe 3384 spoolsv.exe 1912 spoolsv.exe 3036 spoolsv.exe 4112 spoolsv.exe 2236 spoolsv.exe 2464 spoolsv.exe 340 spoolsv.exe 2420 spoolsv.exe 5212 spoolsv.exe 5296 spoolsv.exe 5348 explorer.exe 5388 spoolsv.exe 5488 spoolsv.exe 5564 spoolsv.exe 5636 spoolsv.exe 5700 spoolsv.exe 5772 spoolsv.exe 5840 spoolsv.exe 644 spoolsv.exe 5172 explorer.exe 5512 spoolsv.exe 5552 spoolsv.exe 4760 spoolsv.exe 4568 spoolsv.exe 5704 spoolsv.exe 5804 spoolsv.exe 5832 spoolsv.exe 6052 spoolsv.exe 6084 spoolsv.exe 3444 spoolsv.exe 5540 spoolsv.exe 796 explorer.exe 5556 spoolsv.exe 5644 spoolsv.exe 5560 spoolsv.exe 5784 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 57 IoCs
Processes:
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1884 set thread context of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 4260 set thread context of 1632 4260 explorer.exe explorer.exe PID 1444 set thread context of 5296 1444 spoolsv.exe spoolsv.exe PID 832 set thread context of 5388 832 spoolsv.exe spoolsv.exe PID 2288 set thread context of 5488 2288 spoolsv.exe spoolsv.exe PID 4948 set thread context of 5564 4948 spoolsv.exe spoolsv.exe PID 4368 set thread context of 5636 4368 spoolsv.exe spoolsv.exe PID 2996 set thread context of 5700 2996 spoolsv.exe spoolsv.exe PID 2816 set thread context of 5772 2816 spoolsv.exe spoolsv.exe PID 1796 set thread context of 5840 1796 spoolsv.exe spoolsv.exe PID 3000 set thread context of 644 3000 spoolsv.exe spoolsv.exe PID 4156 set thread context of 5552 4156 spoolsv.exe spoolsv.exe PID 5064 set thread context of 4760 5064 spoolsv.exe spoolsv.exe PID 1884 set thread context of 4568 1884 spoolsv.exe spoolsv.exe PID 4140 set thread context of 5704 4140 spoolsv.exe spoolsv.exe PID 3160 set thread context of 5804 3160 spoolsv.exe spoolsv.exe PID 3436 set thread context of 5832 3436 spoolsv.exe spoolsv.exe PID 1168 set thread context of 6052 1168 spoolsv.exe spoolsv.exe PID 2356 set thread context of 3444 2356 spoolsv.exe spoolsv.exe PID 1032 set thread context of 5540 1032 spoolsv.exe spoolsv.exe PID 3924 set thread context of 5556 3924 spoolsv.exe spoolsv.exe PID 3496 set thread context of 5644 3496 spoolsv.exe spoolsv.exe PID 3504 set thread context of 5560 3504 spoolsv.exe spoolsv.exe PID 5092 set thread context of 5908 5092 spoolsv.exe spoolsv.exe PID 2700 set thread context of 6076 2700 spoolsv.exe spoolsv.exe PID 932 set thread context of 1956 932 spoolsv.exe spoolsv.exe PID 2824 set thread context of 224 2824 spoolsv.exe spoolsv.exe PID 1412 set thread context of 5276 1412 spoolsv.exe spoolsv.exe PID 3384 set thread context of 1128 3384 spoolsv.exe spoolsv.exe PID 1912 set thread context of 348 1912 spoolsv.exe spoolsv.exe PID 3036 set thread context of 1036 3036 spoolsv.exe spoolsv.exe PID 4112 set thread context of 5872 4112 spoolsv.exe spoolsv.exe PID 2236 set thread context of 1000 2236 spoolsv.exe spoolsv.exe PID 2464 set thread context of 6104 2464 spoolsv.exe spoolsv.exe PID 340 set thread context of 6092 340 spoolsv.exe spoolsv.exe PID 2420 set thread context of 3612 2420 spoolsv.exe spoolsv.exe PID 5348 set thread context of 6060 5348 explorer.exe explorer.exe PID 5212 set thread context of 5496 5212 spoolsv.exe spoolsv.exe PID 5512 set thread context of 5400 5512 spoolsv.exe spoolsv.exe PID 5172 set thread context of 440 5172 explorer.exe explorer.exe PID 6084 set thread context of 3672 6084 spoolsv.exe spoolsv.exe PID 796 set thread context of 3936 796 explorer.exe explorer.exe PID 5784 set thread context of 5656 5784 spoolsv.exe spoolsv.exe PID 2348 set thread context of 4196 2348 explorer.exe explorer.exe PID 1644 set thread context of 5420 1644 spoolsv.exe spoolsv.exe PID 3164 set thread context of 3084 3164 explorer.exe explorer.exe PID 1384 set thread context of 4404 1384 spoolsv.exe spoolsv.exe PID 4088 set thread context of 4764 4088 explorer.exe explorer.exe PID 5800 set thread context of 6088 5800 spoolsv.exe spoolsv.exe PID 4836 set thread context of 4348 4836 spoolsv.exe spoolsv.exe PID 5608 set thread context of 4084 5608 spoolsv.exe spoolsv.exe PID 1800 set thread context of 332 1800 spoolsv.exe spoolsv.exe PID 5572 set thread context of 5736 5572 spoolsv.exe spoolsv.exe PID 5260 set thread context of 1620 5260 spoolsv.exe spoolsv.exe PID 3196 set thread context of 2612 3196 spoolsv.exe spoolsv.exe PID 2436 set thread context of 3440 2436 explorer.exe explorer.exe PID 3540 set thread context of 4692 3540 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exea8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exea8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exeexplorer.exepid process 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1632 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 1632 explorer.exe 5296 spoolsv.exe 5296 spoolsv.exe 5388 spoolsv.exe 5388 spoolsv.exe 5488 spoolsv.exe 5488 spoolsv.exe 5564 spoolsv.exe 5564 spoolsv.exe 5636 spoolsv.exe 5636 spoolsv.exe 5700 spoolsv.exe 5700 spoolsv.exe 5772 spoolsv.exe 5772 spoolsv.exe 5840 spoolsv.exe 5840 spoolsv.exe 644 spoolsv.exe 644 spoolsv.exe 5552 spoolsv.exe 5552 spoolsv.exe 4760 spoolsv.exe 4760 spoolsv.exe 4568 spoolsv.exe 4568 spoolsv.exe 5704 spoolsv.exe 5704 spoolsv.exe 5804 spoolsv.exe 5804 spoolsv.exe 5832 spoolsv.exe 5832 spoolsv.exe 6052 spoolsv.exe 6052 spoolsv.exe 3444 spoolsv.exe 3444 spoolsv.exe 5540 spoolsv.exe 5540 spoolsv.exe 5556 spoolsv.exe 5556 spoolsv.exe 5644 spoolsv.exe 5644 spoolsv.exe 5560 spoolsv.exe 5560 spoolsv.exe 5908 spoolsv.exe 5908 spoolsv.exe 6076 spoolsv.exe 6076 spoolsv.exe 1956 spoolsv.exe 1956 spoolsv.exe 224 spoolsv.exe 224 spoolsv.exe 5276 spoolsv.exe 5276 spoolsv.exe 1128 spoolsv.exe 1128 spoolsv.exe 348 spoolsv.exe 348 spoolsv.exe 1036 spoolsv.exe 1036 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exea8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1884 wrote to memory of 2508 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 2508 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe splwow64.exe PID 1884 wrote to memory of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 1884 wrote to memory of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 1884 wrote to memory of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 1884 wrote to memory of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 1884 wrote to memory of 2540 1884 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe PID 2540 wrote to memory of 4260 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe explorer.exe PID 2540 wrote to memory of 4260 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe explorer.exe PID 2540 wrote to memory of 4260 2540 a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe explorer.exe PID 4260 wrote to memory of 1632 4260 explorer.exe explorer.exe PID 4260 wrote to memory of 1632 4260 explorer.exe explorer.exe PID 4260 wrote to memory of 1632 4260 explorer.exe explorer.exe PID 4260 wrote to memory of 1632 4260 explorer.exe explorer.exe PID 4260 wrote to memory of 1632 4260 explorer.exe explorer.exe PID 1632 wrote to memory of 1444 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1444 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1444 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 832 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 832 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 832 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2288 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2288 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2288 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4948 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4948 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4948 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4368 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4368 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4368 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2996 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2996 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2996 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2816 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2816 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2816 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1796 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1796 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1796 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3000 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3000 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3000 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4156 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4156 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4156 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 5064 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 5064 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 5064 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1884 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1884 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1884 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4140 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4140 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 4140 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3160 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3160 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3160 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3436 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3436 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 3436 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1168 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1168 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 1168 1632 explorer.exe spoolsv.exe PID 1632 wrote to memory of 2356 1632 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD531b8a20a1dc79f45ab7fc95f7adf972b
SHA1ee7deeb687d40f2685cd51306737062f8afaee18
SHA25612a4fc7bf575e5c6adda5c8c668493e84f63faf98fe35b84ac2ca50e84355a80
SHA512bb687738d946bf799e939c6112a3b33a844fa501cb58fa47274b50f4858654c65afe02534e6b791998cf760b207c4e30eca7f3cdd8d3d2404519e4e08f28757c
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD56427a6bdbfd56d00d1390917dc17eeee
SHA1df1a765ba5dc7f3b420780deb2b9b7ce9b3d56d9
SHA256939178932e22a481cf7147c103c03387b8423744d0ada8c3c346df5eb9105702
SHA512c4ea44dcc3de46827764a378985016e26caff073645c001eec1196596aba1c58e9a36e75052a7f3a2aa4665c3d20b85f506db66f4e03d53ea96d4c9658863e96
-
memory/224-3024-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/332-5465-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/348-3130-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/440-4257-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/644-2824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/644-2524-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/832-2363-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/832-1211-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/908-5781-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/908-5778-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/932-2361-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1000-3220-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1032-2042-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1036-3362-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1036-3202-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1168-2040-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1444-1005-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1444-2355-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1620-5559-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1620-5562-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1632-999-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1632-84-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1796-1387-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1884-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1884-28-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1884-32-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1884-0-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1884-1828-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2288-2377-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2288-1212-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2356-2041-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2540-67-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2540-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2540-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2540-68-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2700-2353-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2816-1386-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2824-2373-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2996-1385-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3000-1598-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3084-5132-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3160-1830-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3436-2039-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3440-5582-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3496-2238-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3504-2239-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3612-3524-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-4527-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3924-2237-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3936-4536-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4084-5438-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-1829-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4156-1599-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4196-4924-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-79-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4260-85-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4368-1384-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4568-2629-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4692-5708-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4692-5809-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4760-2619-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4948-1213-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5012-5907-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5064-1600-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5092-2352-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5296-2354-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5296-2505-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5388-2362-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5388-2366-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5400-4309-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5400-4189-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5420-5123-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5420-5258-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5488-2379-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5488-2374-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5496-3936-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5540-2989-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5540-2842-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5552-2606-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5552-2611-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5556-2850-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5560-2869-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5564-2387-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5636-2398-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5644-2860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5656-4855-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5656-4986-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5700-2409-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5704-2640-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5704-2644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5736-5549-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5772-2419-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5804-2656-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5840-2445-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5872-3209-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5908-2948-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6052-2741-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6060-3798-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6076-3184-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6076-3007-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6092-3237-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6104-3230-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB