Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 01:22
Behavioral task
behavioral1
Sample
b11547615626efb914c504570a34346f_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b11547615626efb914c504570a34346f_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b11547615626efb914c504570a34346f
-
SHA1
77d0b12acba536c9fc2c3053cfc9ddabb15f290b
-
SHA256
4e8793860a4c10f969b509c039127875ec35821726d64046e7beb8f292fb72b2
-
SHA512
8ed746cd83600c15a504a3ccffee85ed39a921e8cd07b42221cbf4aaeea3d23e0ddd4a0d487650d5e5763da294bc3dffd9510bd282470f7eceb08f3db001e153
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwF
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b11547615626efb914c504570a34346f_JaffaCakes118.exe b11547615626efb914c504570a34346f_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b11547615626efb914c504570a34346f_JaffaCakes118.exe b11547615626efb914c504570a34346f_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3660 explorer.exe 3872 explorer.exe 4836 spoolsv.exe 1164 spoolsv.exe 2620 spoolsv.exe 2308 spoolsv.exe 492 spoolsv.exe 5040 spoolsv.exe 4700 spoolsv.exe 1552 spoolsv.exe 1356 spoolsv.exe 2724 spoolsv.exe 2984 spoolsv.exe 1720 spoolsv.exe 3504 spoolsv.exe 3520 spoolsv.exe 1340 spoolsv.exe 2948 spoolsv.exe 1880 spoolsv.exe 3964 spoolsv.exe 3480 spoolsv.exe 4076 spoolsv.exe 3928 spoolsv.exe 4736 spoolsv.exe 4048 spoolsv.exe 3144 spoolsv.exe 3840 spoolsv.exe 4636 spoolsv.exe 1508 spoolsv.exe 784 spoolsv.exe 2968 spoolsv.exe 2656 spoolsv.exe 1292 spoolsv.exe 1104 spoolsv.exe 1680 spoolsv.exe 900 explorer.exe 4528 spoolsv.exe 5048 spoolsv.exe 2748 spoolsv.exe 3084 spoolsv.exe 1828 spoolsv.exe 1752 spoolsv.exe 1116 explorer.exe 660 spoolsv.exe 4876 spoolsv.exe 4068 spoolsv.exe 4500 spoolsv.exe 4852 spoolsv.exe 3484 spoolsv.exe 3596 spoolsv.exe 1448 spoolsv.exe 1236 spoolsv.exe 4424 spoolsv.exe 1204 spoolsv.exe 3976 spoolsv.exe 3968 spoolsv.exe 2488 spoolsv.exe 2200 spoolsv.exe 4116 spoolsv.exe 4336 spoolsv.exe 1376 explorer.exe 4576 spoolsv.exe 4480 spoolsv.exe 1040 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
description pid Process procid_target PID 3668 set thread context of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 3660 set thread context of 3872 3660 explorer.exe 95 PID 4836 set thread context of 1680 4836 spoolsv.exe 128 PID 1164 set thread context of 4528 1164 spoolsv.exe 130 PID 2620 set thread context of 5048 2620 spoolsv.exe 131 PID 2308 set thread context of 2748 2308 spoolsv.exe 132 PID 492 set thread context of 1828 492 spoolsv.exe 134 PID 5040 set thread context of 1752 5040 spoolsv.exe 135 PID 4700 set thread context of 660 4700 spoolsv.exe 137 PID 1552 set thread context of 4876 1552 spoolsv.exe 138 PID 1356 set thread context of 4068 1356 spoolsv.exe 139 PID 2724 set thread context of 4500 2724 spoolsv.exe 140 PID 2984 set thread context of 4852 2984 spoolsv.exe 141 PID 1720 set thread context of 3484 1720 spoolsv.exe 143 PID 3504 set thread context of 1448 3504 spoolsv.exe 144 PID 3520 set thread context of 1236 3520 spoolsv.exe 145 PID 1340 set thread context of 4424 1340 spoolsv.exe 146 PID 2948 set thread context of 1204 2948 spoolsv.exe 147 PID 1880 set thread context of 3976 1880 spoolsv.exe 148 PID 3964 set thread context of 3968 3964 spoolsv.exe 150 PID 3928 set thread context of 2488 3928 spoolsv.exe 152 PID 3480 set thread context of 4336 3480 spoolsv.exe 149 PID 4076 set thread context of 2200 4076 spoolsv.exe 151 PID 4736 set thread context of 4116 4736 spoolsv.exe 153 PID 4048 set thread context of 4576 4048 spoolsv.exe 155 PID 3144 set thread context of 4480 3144 spoolsv.exe 156 PID 3840 set thread context of 1040 3840 spoolsv.exe 157 PID 4636 set thread context of 1176 4636 spoolsv.exe 158 PID 1508 set thread context of 4060 1508 spoolsv.exe 159 PID 784 set thread context of 1636 784 spoolsv.exe 160 PID 2968 set thread context of 4064 2968 spoolsv.exe 161 PID 2656 set thread context of 1308 2656 spoolsv.exe 163 PID 1292 set thread context of 3140 1292 spoolsv.exe 166 PID 1104 set thread context of 2440 1104 spoolsv.exe 171 PID 900 set thread context of 3340 900 explorer.exe 174 PID 3084 set thread context of 1576 3084 spoolsv.exe 187 PID 1116 set thread context of 3924 1116 explorer.exe 191 PID 1376 set thread context of 828 1376 explorer.exe 192 PID 3596 set thread context of 4440 3596 spoolsv.exe 193 PID 2068 set thread context of 5088 2068 spoolsv.exe 195 PID 4704 set thread context of 4940 4704 explorer.exe 196 PID 1432 set thread context of 4648 1432 spoolsv.exe 197 PID 4388 set thread context of 3996 4388 explorer.exe 198 PID 4932 set thread context of 4592 4932 spoolsv.exe 199 PID 1372 set thread context of 5084 1372 spoolsv.exe 201 PID 3492 set thread context of 64 3492 spoolsv.exe 203 PID 2004 set thread context of 4296 2004 explorer.exe 204 PID 600 set thread context of 2840 600 spoolsv.exe 206 PID 5068 set thread context of 2644 5068 spoolsv.exe 208 PID 3216 set thread context of 3136 3216 spoolsv.exe 210 PID 1668 set thread context of 2400 1668 spoolsv.exe 213 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b11547615626efb914c504570a34346f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b11547615626efb914c504570a34346f_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3872 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 1680 spoolsv.exe 1680 spoolsv.exe 4528 spoolsv.exe 4528 spoolsv.exe 5048 spoolsv.exe 5048 spoolsv.exe 2748 spoolsv.exe 2748 spoolsv.exe 1828 spoolsv.exe 1828 spoolsv.exe 1752 spoolsv.exe 1752 spoolsv.exe 660 spoolsv.exe 660 spoolsv.exe 4876 spoolsv.exe 4876 spoolsv.exe 4068 spoolsv.exe 4068 spoolsv.exe 4500 spoolsv.exe 4500 spoolsv.exe 4852 spoolsv.exe 4852 spoolsv.exe 3484 spoolsv.exe 3484 spoolsv.exe 1448 spoolsv.exe 1448 spoolsv.exe 1236 spoolsv.exe 1236 spoolsv.exe 4424 spoolsv.exe 4424 spoolsv.exe 1204 spoolsv.exe 1204 spoolsv.exe 3976 spoolsv.exe 3976 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 2200 spoolsv.exe 2200 spoolsv.exe 4116 spoolsv.exe 4116 spoolsv.exe 4336 spoolsv.exe 4336 spoolsv.exe 4576 spoolsv.exe 4576 spoolsv.exe 4480 spoolsv.exe 4480 spoolsv.exe 1040 spoolsv.exe 1040 spoolsv.exe 1176 spoolsv.exe 1176 spoolsv.exe 4060 spoolsv.exe 4060 spoolsv.exe 1636 spoolsv.exe 1636 spoolsv.exe 4064 spoolsv.exe 4064 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 4548 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 81 PID 3668 wrote to memory of 4548 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 81 PID 3668 wrote to memory of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 3668 wrote to memory of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 3668 wrote to memory of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 3668 wrote to memory of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 3668 wrote to memory of 2828 3668 b11547615626efb914c504570a34346f_JaffaCakes118.exe 86 PID 2828 wrote to memory of 3660 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 87 PID 2828 wrote to memory of 3660 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 87 PID 2828 wrote to memory of 3660 2828 b11547615626efb914c504570a34346f_JaffaCakes118.exe 87 PID 3660 wrote to memory of 3872 3660 explorer.exe 95 PID 3660 wrote to memory of 3872 3660 explorer.exe 95 PID 3660 wrote to memory of 3872 3660 explorer.exe 95 PID 3660 wrote to memory of 3872 3660 explorer.exe 95 PID 3660 wrote to memory of 3872 3660 explorer.exe 95 PID 3872 wrote to memory of 4836 3872 explorer.exe 96 PID 3872 wrote to memory of 4836 3872 explorer.exe 96 PID 3872 wrote to memory of 4836 3872 explorer.exe 96 PID 3872 wrote to memory of 1164 3872 explorer.exe 97 PID 3872 wrote to memory of 1164 3872 explorer.exe 97 PID 3872 wrote to memory of 1164 3872 explorer.exe 97 PID 3872 wrote to memory of 2620 3872 explorer.exe 98 PID 3872 wrote to memory of 2620 3872 explorer.exe 98 PID 3872 wrote to memory of 2620 3872 explorer.exe 98 PID 3872 wrote to memory of 2308 3872 explorer.exe 99 PID 3872 wrote to memory of 2308 3872 explorer.exe 99 PID 3872 wrote to memory of 2308 3872 explorer.exe 99 PID 3872 wrote to memory of 492 3872 explorer.exe 100 PID 3872 wrote to memory of 492 3872 explorer.exe 100 PID 3872 wrote to memory of 492 3872 explorer.exe 100 PID 3872 wrote to memory of 5040 3872 explorer.exe 101 PID 3872 wrote to memory of 5040 3872 explorer.exe 101 PID 3872 wrote to memory of 5040 3872 explorer.exe 101 PID 3872 wrote to memory of 4700 3872 explorer.exe 102 PID 3872 wrote to memory of 4700 3872 explorer.exe 102 PID 3872 wrote to memory of 4700 3872 explorer.exe 102 PID 3872 wrote to memory of 1552 3872 explorer.exe 103 PID 3872 wrote to memory of 1552 3872 explorer.exe 103 PID 3872 wrote to memory of 1552 3872 explorer.exe 103 PID 3872 wrote to memory of 1356 3872 explorer.exe 104 PID 3872 wrote to memory of 1356 3872 explorer.exe 104 PID 3872 wrote to memory of 1356 3872 explorer.exe 104 PID 3872 wrote to memory of 2724 3872 explorer.exe 105 PID 3872 wrote to memory of 2724 3872 explorer.exe 105 PID 3872 wrote to memory of 2724 3872 explorer.exe 105 PID 3872 wrote to memory of 2984 3872 explorer.exe 106 PID 3872 wrote to memory of 2984 3872 explorer.exe 106 PID 3872 wrote to memory of 2984 3872 explorer.exe 106 PID 3872 wrote to memory of 1720 3872 explorer.exe 107 PID 3872 wrote to memory of 1720 3872 explorer.exe 107 PID 3872 wrote to memory of 1720 3872 explorer.exe 107 PID 3872 wrote to memory of 3504 3872 explorer.exe 108 PID 3872 wrote to memory of 3504 3872 explorer.exe 108 PID 3872 wrote to memory of 3504 3872 explorer.exe 108 PID 3872 wrote to memory of 3520 3872 explorer.exe 109 PID 3872 wrote to memory of 3520 3872 explorer.exe 109 PID 3872 wrote to memory of 3520 3872 explorer.exe 109 PID 3872 wrote to memory of 1340 3872 explorer.exe 110 PID 3872 wrote to memory of 1340 3872 explorer.exe 110 PID 3872 wrote to memory of 1340 3872 explorer.exe 110 PID 3872 wrote to memory of 2948 3872 explorer.exe 111 PID 3872 wrote to memory of 2948 3872 explorer.exe 111 PID 3872 wrote to memory of 2948 3872 explorer.exe 111 PID 3872 wrote to memory of 1880 3872 explorer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\b11547615626efb914c504570a34346f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b11547615626efb914c504570a34346f_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4548
-
-
C:\Users\Admin\AppData\Local\Temp\b11547615626efb914c504570a34346f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b11547615626efb914c504570a34346f_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:900 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3340
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1116 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3924
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:660
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4876
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4500
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4852
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4336
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:828
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4048 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1308
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4704 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4940
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1292 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3140
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4388 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3996
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2440
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2004 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4296
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1576
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:464
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4440
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4192
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5088
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:1432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5084
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3376
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:64
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2840
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3476
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2644
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3136
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2788
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4856
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1360
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3368
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4596
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3208
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2084
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2204
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2184
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5f08d8fe23f64fd12ebe7f83150d88eca
SHA15b6276b6936fd6ad9c6cd07c09b0d9ae616f6840
SHA256d272c0f2cbc94e7bf6498a12b27616070bf095d51071776ff25320a7b3b8faf0
SHA51267002322c8b7855118402430701d499a77313bf1be8c7ee4e63778936c52219a4317dc791e9252a086f39faf1f71e0537e1bcd33d2f4c3a1f267419ed1ea4407
-
Filesize
2.2MB
MD5b1e57dff92b78436c6176b1b9323bd72
SHA1faf9c3015656a743eed1a576feb771173644d80d
SHA2567fe2d5b713af8eeef81d447046bbf0a70e5192d19fc2d0e62fc8fe796bf0203d
SHA5129468778490662bc3194a9192ee31a7959e5bbf26a2494635e6bc5fe11ca6582589d8d0147c18b72edd7e6bd27a032cdbd3034647081f102deb5dbb9ab3be885d