Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 15:43
Behavioral task
behavioral1
Sample
b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b44a19a091c67b112e1058d80299c7da
-
SHA1
31df24ea348bccb90c60ab4274edd786253a3081
-
SHA256
c589f87a0230b5418bb996e31cd87d90f0e1f47214a236cf50cd65f0965bb13f
-
SHA512
4c69ccb2d4efbbd6300e38407f898d5e44df01ebb6e54a75e75561533f6ed9f5f0117221796c72981d750a5232f0ac2e7c2a79db8e343ae280e390ecf352cba2
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWwwk
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4636 explorer.exe 3360 explorer.exe 4896 spoolsv.exe 4940 spoolsv.exe 3832 spoolsv.exe 620 spoolsv.exe 1968 spoolsv.exe 3432 spoolsv.exe 2432 spoolsv.exe 1920 spoolsv.exe 1656 spoolsv.exe 3512 spoolsv.exe 3496 spoolsv.exe 5056 spoolsv.exe 1552 spoolsv.exe 5076 spoolsv.exe 4752 spoolsv.exe 2516 spoolsv.exe 5028 spoolsv.exe 2984 spoolsv.exe 2964 spoolsv.exe 116 spoolsv.exe 3032 spoolsv.exe 3524 spoolsv.exe 880 spoolsv.exe 2300 spoolsv.exe 2228 spoolsv.exe 3564 spoolsv.exe 436 spoolsv.exe 708 spoolsv.exe 5116 spoolsv.exe 3704 spoolsv.exe 4776 spoolsv.exe 4124 spoolsv.exe 4324 spoolsv.exe 2812 explorer.exe 3448 spoolsv.exe 4056 spoolsv.exe 3328 spoolsv.exe 4384 spoolsv.exe 4000 spoolsv.exe 4344 spoolsv.exe 1396 explorer.exe 2264 spoolsv.exe 4632 spoolsv.exe 2968 spoolsv.exe 3460 spoolsv.exe 636 spoolsv.exe 3804 spoolsv.exe 2892 spoolsv.exe 3152 explorer.exe 1012 spoolsv.exe 3976 spoolsv.exe 1708 spoolsv.exe 3968 spoolsv.exe 4312 spoolsv.exe 2588 spoolsv.exe 2436 spoolsv.exe 3000 spoolsv.exe 2000 explorer.exe 4204 spoolsv.exe 1908 spoolsv.exe 832 spoolsv.exe 652 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 44 IoCs
description pid Process procid_target PID 1484 set thread context of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 4636 set thread context of 3360 4636 explorer.exe 92 PID 4896 set thread context of 4324 4896 spoolsv.exe 125 PID 4940 set thread context of 3448 4940 spoolsv.exe 127 PID 3832 set thread context of 3328 3832 spoolsv.exe 129 PID 620 set thread context of 4384 620 spoolsv.exe 130 PID 1968 set thread context of 4000 1968 spoolsv.exe 131 PID 3432 set thread context of 4344 3432 spoolsv.exe 132 PID 2432 set thread context of 4632 2432 spoolsv.exe 135 PID 1920 set thread context of 2968 1920 spoolsv.exe 136 PID 1656 set thread context of 3460 1656 spoolsv.exe 137 PID 3512 set thread context of 636 3512 spoolsv.exe 138 PID 3496 set thread context of 3804 3496 spoolsv.exe 139 PID 5056 set thread context of 2892 5056 spoolsv.exe 140 PID 1552 set thread context of 3976 1552 spoolsv.exe 143 PID 5076 set thread context of 1708 5076 spoolsv.exe 144 PID 4752 set thread context of 3968 4752 spoolsv.exe 145 PID 2516 set thread context of 4312 2516 spoolsv.exe 146 PID 5028 set thread context of 2588 5028 spoolsv.exe 147 PID 2984 set thread context of 3000 2984 spoolsv.exe 149 PID 2964 set thread context of 4204 2964 spoolsv.exe 151 PID 116 set thread context of 1908 116 spoolsv.exe 152 PID 3032 set thread context of 832 3032 spoolsv.exe 153 PID 3524 set thread context of 652 3524 spoolsv.exe 154 PID 880 set thread context of 4988 880 spoolsv.exe 156 PID 2300 set thread context of 2068 2300 spoolsv.exe 158 PID 2228 set thread context of 2988 2228 spoolsv.exe 159 PID 3564 set thread context of 2444 3564 spoolsv.exe 160 PID 436 set thread context of 2824 436 spoolsv.exe 161 PID 708 set thread context of 996 708 spoolsv.exe 162 PID 5116 set thread context of 1568 5116 spoolsv.exe 163 PID 3704 set thread context of 5060 3704 spoolsv.exe 165 PID 4776 set thread context of 1924 4776 spoolsv.exe 167 PID 4124 set thread context of 3692 4124 spoolsv.exe 170 PID 2812 set thread context of 3076 2812 explorer.exe 175 PID 4056 set thread context of 2156 4056 spoolsv.exe 176 PID 1396 set thread context of 2972 1396 explorer.exe 182 PID 2264 set thread context of 3984 2264 spoolsv.exe 183 PID 1012 set thread context of 1248 1012 spoolsv.exe 188 PID 3152 set thread context of 3860 3152 explorer.exe 190 PID 2436 set thread context of 3816 2436 spoolsv.exe 194 PID 2000 set thread context of 3016 2000 explorer.exe 196 PID 768 set thread context of 4876 768 spoolsv.exe 200 PID 5048 set thread context of 1512 5048 explorer.exe 202 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3360 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 3360 explorer.exe 4324 spoolsv.exe 4324 spoolsv.exe 3448 spoolsv.exe 3448 spoolsv.exe 3328 spoolsv.exe 3328 spoolsv.exe 4384 spoolsv.exe 4384 spoolsv.exe 4000 spoolsv.exe 4000 spoolsv.exe 4344 spoolsv.exe 4344 spoolsv.exe 4632 spoolsv.exe 4632 spoolsv.exe 2968 spoolsv.exe 2968 spoolsv.exe 3460 spoolsv.exe 3460 spoolsv.exe 636 spoolsv.exe 636 spoolsv.exe 3804 spoolsv.exe 3804 spoolsv.exe 2892 spoolsv.exe 2892 spoolsv.exe 3976 spoolsv.exe 3976 spoolsv.exe 1708 spoolsv.exe 1708 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 4312 spoolsv.exe 4312 spoolsv.exe 2588 spoolsv.exe 2588 spoolsv.exe 3000 spoolsv.exe 3000 spoolsv.exe 4204 spoolsv.exe 4204 spoolsv.exe 1908 spoolsv.exe 1908 spoolsv.exe 832 spoolsv.exe 832 spoolsv.exe 652 spoolsv.exe 652 spoolsv.exe 4988 spoolsv.exe 4988 spoolsv.exe 2068 spoolsv.exe 2068 spoolsv.exe 2988 spoolsv.exe 2988 spoolsv.exe 2444 spoolsv.exe 2444 spoolsv.exe 2824 spoolsv.exe 2824 spoolsv.exe 996 spoolsv.exe 996 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 4872 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 82 PID 1484 wrote to memory of 4872 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 82 PID 1484 wrote to memory of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 1484 wrote to memory of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 1484 wrote to memory of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 1484 wrote to memory of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 1484 wrote to memory of 4248 1484 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 87 PID 4248 wrote to memory of 4636 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 88 PID 4248 wrote to memory of 4636 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 88 PID 4248 wrote to memory of 4636 4248 b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe 88 PID 4636 wrote to memory of 3360 4636 explorer.exe 92 PID 4636 wrote to memory of 3360 4636 explorer.exe 92 PID 4636 wrote to memory of 3360 4636 explorer.exe 92 PID 4636 wrote to memory of 3360 4636 explorer.exe 92 PID 4636 wrote to memory of 3360 4636 explorer.exe 92 PID 3360 wrote to memory of 4896 3360 explorer.exe 93 PID 3360 wrote to memory of 4896 3360 explorer.exe 93 PID 3360 wrote to memory of 4896 3360 explorer.exe 93 PID 3360 wrote to memory of 4940 3360 explorer.exe 94 PID 3360 wrote to memory of 4940 3360 explorer.exe 94 PID 3360 wrote to memory of 4940 3360 explorer.exe 94 PID 3360 wrote to memory of 3832 3360 explorer.exe 95 PID 3360 wrote to memory of 3832 3360 explorer.exe 95 PID 3360 wrote to memory of 3832 3360 explorer.exe 95 PID 3360 wrote to memory of 620 3360 explorer.exe 96 PID 3360 wrote to memory of 620 3360 explorer.exe 96 PID 3360 wrote to memory of 620 3360 explorer.exe 96 PID 3360 wrote to memory of 1968 3360 explorer.exe 97 PID 3360 wrote to memory of 1968 3360 explorer.exe 97 PID 3360 wrote to memory of 1968 3360 explorer.exe 97 PID 3360 wrote to memory of 3432 3360 explorer.exe 98 PID 3360 wrote to memory of 3432 3360 explorer.exe 98 PID 3360 wrote to memory of 3432 3360 explorer.exe 98 PID 3360 wrote to memory of 2432 3360 explorer.exe 99 PID 3360 wrote to memory of 2432 3360 explorer.exe 99 PID 3360 wrote to memory of 2432 3360 explorer.exe 99 PID 3360 wrote to memory of 1920 3360 explorer.exe 100 PID 3360 wrote to memory of 1920 3360 explorer.exe 100 PID 3360 wrote to memory of 1920 3360 explorer.exe 100 PID 3360 wrote to memory of 1656 3360 explorer.exe 101 PID 3360 wrote to memory of 1656 3360 explorer.exe 101 PID 3360 wrote to memory of 1656 3360 explorer.exe 101 PID 3360 wrote to memory of 3512 3360 explorer.exe 102 PID 3360 wrote to memory of 3512 3360 explorer.exe 102 PID 3360 wrote to memory of 3512 3360 explorer.exe 102 PID 3360 wrote to memory of 3496 3360 explorer.exe 103 PID 3360 wrote to memory of 3496 3360 explorer.exe 103 PID 3360 wrote to memory of 3496 3360 explorer.exe 103 PID 3360 wrote to memory of 5056 3360 explorer.exe 104 PID 3360 wrote to memory of 5056 3360 explorer.exe 104 PID 3360 wrote to memory of 5056 3360 explorer.exe 104 PID 3360 wrote to memory of 1552 3360 explorer.exe 105 PID 3360 wrote to memory of 1552 3360 explorer.exe 105 PID 3360 wrote to memory of 1552 3360 explorer.exe 105 PID 3360 wrote to memory of 5076 3360 explorer.exe 106 PID 3360 wrote to memory of 5076 3360 explorer.exe 106 PID 3360 wrote to memory of 5076 3360 explorer.exe 106 PID 3360 wrote to memory of 4752 3360 explorer.exe 107 PID 3360 wrote to memory of 4752 3360 explorer.exe 107 PID 3360 wrote to memory of 4752 3360 explorer.exe 107 PID 3360 wrote to memory of 2516 3360 explorer.exe 108 PID 3360 wrote to memory of 2516 3360 explorer.exe 108 PID 3360 wrote to memory of 2516 3360 explorer.exe 108 PID 3360 wrote to memory of 5028 3360 explorer.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b44a19a091c67b112e1058d80299c7da_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4324 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2812 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3076
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3328
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4384
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1396 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2972
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2892 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3152 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3860
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3976
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2000 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3016
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5048 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1512
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2824
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5060
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:752 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3740
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3092 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3548
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2156
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3464 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4964
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3984
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:8
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4116
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1248
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4220
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3816
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1164
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4876
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4600
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:60 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2688
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4224
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5108 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:404
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5100
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1264
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2368
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2392
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:544
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2496
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:212
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4308
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1828
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3724
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD572890e20143ff5f282af5650fd18afe2
SHA103065d685ef0e054f0d7cc04b59b527f06193ed5
SHA256d81dc94e9cd44d29c932a11f4e5076dd061fdc868d1f95241f6dde3a7ef635e6
SHA5120daa22a9f982564d28ed85b8f4a23a961e0716cd1c88b2371622389b6ab5173960fe1f9115c56877570bf1502bd19e7320b077a662d52a60919453a8bcbac254
-
Filesize
2.2MB
MD5fe012c0f3498f2eee267b76c78a967e4
SHA1f2664befe1066480046d6223b86a1719a958e730
SHA2564587e0d2eaa91a2ed95270eaf8800a809f84f198395bff5c0dc9a2e4d034c4fa
SHA51296e564d797f8f863e27326fc7fdd4fa9acd34358287a048b0bcc2f7dffcdb1cab82fb4619cfc8be395671cd2296810e28c7ae80d4abb33aa46cd8b8d6f35efcf