Analysis
-
max time kernel
111s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 18:36
Behavioral task
behavioral1
Sample
b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b49a1d585fc3d4540bd50d3ce745ea6c
-
SHA1
20c663eec3eb853cf51c5bafef637c5a91fa57dd
-
SHA256
e61c4aa5b19af3cc8c85fd5037bac8168c1aab05986c266be8aec2cb5b796456
-
SHA512
97566750896097f29887940c3b34da6f30e39750ac57215ca163f4e0a3c82986e2d3372e6fbc46b33c6cf09b66ffdaf463fcbab860a701f3da9505aa2a494115
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZn:0UzeyQMS4DqodCnoe+iitjWwwL
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4020 explorer.exe 2312 explorer.exe 5064 spoolsv.exe 4476 spoolsv.exe 620 spoolsv.exe 4588 spoolsv.exe 1772 spoolsv.exe 2736 spoolsv.exe 1272 spoolsv.exe 3448 spoolsv.exe 888 spoolsv.exe 536 spoolsv.exe 2744 spoolsv.exe 4532 spoolsv.exe 3768 spoolsv.exe 3904 spoolsv.exe 1728 spoolsv.exe 4076 spoolsv.exe 4896 spoolsv.exe 916 spoolsv.exe 4944 spoolsv.exe 220 spoolsv.exe 3776 spoolsv.exe 4620 spoolsv.exe 4904 spoolsv.exe 3004 spoolsv.exe 1624 explorer.exe 3792 spoolsv.exe 3416 spoolsv.exe 4788 spoolsv.exe 3808 spoolsv.exe 2024 explorer.exe 2324 spoolsv.exe 2256 spoolsv.exe 4488 spoolsv.exe 3472 explorer.exe 3148 spoolsv.exe 4600 spoolsv.exe 4492 spoolsv.exe 3712 explorer.exe 4340 spoolsv.exe 4048 spoolsv.exe 512 spoolsv.exe 4812 spoolsv.exe 1492 explorer.exe 1900 spoolsv.exe 208 spoolsv.exe 1976 spoolsv.exe 1724 explorer.exe 3312 spoolsv.exe 2360 spoolsv.exe 1404 spoolsv.exe 212 explorer.exe 2364 spoolsv.exe 4380 spoolsv.exe 4196 spoolsv.exe 3916 spoolsv.exe 4252 explorer.exe 2924 spoolsv.exe 4368 spoolsv.exe 956 spoolsv.exe 1648 explorer.exe 3544 spoolsv.exe 8 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 21 IoCs
description pid Process procid_target PID 3448 set thread context of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 4020 set thread context of 2312 4020 explorer.exe 94 PID 5064 set thread context of 3004 5064 spoolsv.exe 118 PID 4476 set thread context of 3416 4476 spoolsv.exe 121 PID 620 set thread context of 3808 620 spoolsv.exe 123 PID 4588 set thread context of 2324 4588 spoolsv.exe 125 PID 1772 set thread context of 4488 1772 spoolsv.exe 127 PID 2736 set thread context of 3148 2736 spoolsv.exe 129 PID 1272 set thread context of 4492 1272 spoolsv.exe 131 PID 3448 set thread context of 4048 3448 spoolsv.exe 134 PID 888 set thread context of 4812 888 spoolsv.exe 136 PID 536 set thread context of 1900 536 spoolsv.exe 138 PID 2744 set thread context of 1976 2744 spoolsv.exe 140 PID 4532 set thread context of 2360 4532 spoolsv.exe 143 PID 3768 set thread context of 1404 3768 spoolsv.exe 144 PID 3904 set thread context of 4380 3904 spoolsv.exe 147 PID 1728 set thread context of 3916 1728 spoolsv.exe 149 PID 4076 set thread context of 2924 4076 spoolsv.exe 151 PID 4896 set thread context of 956 4896 spoolsv.exe 153 PID 916 set thread context of 3544 916 spoolsv.exe 155 PID 4944 set thread context of 3764 4944 spoolsv.exe 157 -
Drops file in Windows directory 49 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
pid Process 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 3004 spoolsv.exe 3004 spoolsv.exe 3416 spoolsv.exe 3416 spoolsv.exe 3808 spoolsv.exe 3808 spoolsv.exe 2324 spoolsv.exe 2324 spoolsv.exe 4488 spoolsv.exe 4488 spoolsv.exe 3148 spoolsv.exe 3148 spoolsv.exe 4492 spoolsv.exe 4492 spoolsv.exe 4048 spoolsv.exe 4048 spoolsv.exe 4812 spoolsv.exe 4812 spoolsv.exe 1900 spoolsv.exe 1900 spoolsv.exe 1976 spoolsv.exe 1976 spoolsv.exe 2360 spoolsv.exe 2360 spoolsv.exe 1404 spoolsv.exe 1404 spoolsv.exe 4380 spoolsv.exe 4380 spoolsv.exe 3916 spoolsv.exe 3916 spoolsv.exe 2924 spoolsv.exe 2924 spoolsv.exe 956 spoolsv.exe 956 spoolsv.exe 3544 spoolsv.exe 3544 spoolsv.exe 3764 spoolsv.exe 3764 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3448 wrote to memory of 4656 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 84 PID 3448 wrote to memory of 4656 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 84 PID 3448 wrote to memory of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 3448 wrote to memory of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 3448 wrote to memory of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 3448 wrote to memory of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 3448 wrote to memory of 3008 3448 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 89 PID 3008 wrote to memory of 4020 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 90 PID 3008 wrote to memory of 4020 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 90 PID 3008 wrote to memory of 4020 3008 b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe 90 PID 4020 wrote to memory of 2312 4020 explorer.exe 94 PID 4020 wrote to memory of 2312 4020 explorer.exe 94 PID 4020 wrote to memory of 2312 4020 explorer.exe 94 PID 4020 wrote to memory of 2312 4020 explorer.exe 94 PID 4020 wrote to memory of 2312 4020 explorer.exe 94 PID 2312 wrote to memory of 5064 2312 explorer.exe 95 PID 2312 wrote to memory of 5064 2312 explorer.exe 95 PID 2312 wrote to memory of 5064 2312 explorer.exe 95 PID 2312 wrote to memory of 4476 2312 explorer.exe 96 PID 2312 wrote to memory of 4476 2312 explorer.exe 96 PID 2312 wrote to memory of 4476 2312 explorer.exe 96 PID 2312 wrote to memory of 620 2312 explorer.exe 97 PID 2312 wrote to memory of 620 2312 explorer.exe 97 PID 2312 wrote to memory of 620 2312 explorer.exe 97 PID 2312 wrote to memory of 4588 2312 explorer.exe 98 PID 2312 wrote to memory of 4588 2312 explorer.exe 98 PID 2312 wrote to memory of 4588 2312 explorer.exe 98 PID 2312 wrote to memory of 1772 2312 explorer.exe 99 PID 2312 wrote to memory of 1772 2312 explorer.exe 99 PID 2312 wrote to memory of 1772 2312 explorer.exe 99 PID 2312 wrote to memory of 2736 2312 explorer.exe 100 PID 2312 wrote to memory of 2736 2312 explorer.exe 100 PID 2312 wrote to memory of 2736 2312 explorer.exe 100 PID 2312 wrote to memory of 1272 2312 explorer.exe 101 PID 2312 wrote to memory of 1272 2312 explorer.exe 101 PID 2312 wrote to memory of 1272 2312 explorer.exe 101 PID 2312 wrote to memory of 3448 2312 explorer.exe 102 PID 2312 wrote to memory of 3448 2312 explorer.exe 102 PID 2312 wrote to memory of 3448 2312 explorer.exe 102 PID 2312 wrote to memory of 888 2312 explorer.exe 103 PID 2312 wrote to memory of 888 2312 explorer.exe 103 PID 2312 wrote to memory of 888 2312 explorer.exe 103 PID 2312 wrote to memory of 536 2312 explorer.exe 104 PID 2312 wrote to memory of 536 2312 explorer.exe 104 PID 2312 wrote to memory of 536 2312 explorer.exe 104 PID 2312 wrote to memory of 2744 2312 explorer.exe 105 PID 2312 wrote to memory of 2744 2312 explorer.exe 105 PID 2312 wrote to memory of 2744 2312 explorer.exe 105 PID 2312 wrote to memory of 4532 2312 explorer.exe 106 PID 2312 wrote to memory of 4532 2312 explorer.exe 106 PID 2312 wrote to memory of 4532 2312 explorer.exe 106 PID 2312 wrote to memory of 3768 2312 explorer.exe 107 PID 2312 wrote to memory of 3768 2312 explorer.exe 107 PID 2312 wrote to memory of 3768 2312 explorer.exe 107 PID 2312 wrote to memory of 3904 2312 explorer.exe 108 PID 2312 wrote to memory of 3904 2312 explorer.exe 108 PID 2312 wrote to memory of 3904 2312 explorer.exe 108 PID 2312 wrote to memory of 1728 2312 explorer.exe 109 PID 2312 wrote to memory of 1728 2312 explorer.exe 109 PID 2312 wrote to memory of 1728 2312 explorer.exe 109 PID 2312 wrote to memory of 4076 2312 explorer.exe 110 PID 2312 wrote to memory of 4076 2312 explorer.exe 110 PID 2312 wrote to memory of 4076 2312 explorer.exe 110 PID 2312 wrote to memory of 4896 2312 explorer.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b49a1d585fc3d4540bd50d3ce745ea6c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3004 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2588
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3808 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4804
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3472 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4012
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4492 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3712 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4560
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4812 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1492 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2904
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1724 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4468
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3128
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3916 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4252 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2416
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:956 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1328
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3544
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1932
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1028
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:388
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2376
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4668
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4520
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2148
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4148
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2704
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1876
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1636
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4844
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4828
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3456
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3200
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3360
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3648
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2544
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2348
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3896
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2116
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3196
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3540
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3204
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3716
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:628
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5012
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4372
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4644
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:940
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4652
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4908
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4912
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2012
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4868
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2148
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4948
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3412
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2040
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1088
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4640
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4900
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1144
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2836
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3780
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5205c708310fee104dea0ff4dedcad95b
SHA126eaa28e5bd9feb6e632cdcedcc2153459e86476
SHA25626cd8a6aa7f06cecb9fc72232c9e6e408f730d00d2f729e7c0effe9e4fe1855e
SHA5125e40f05b24446fcf6fb660788a3742e27eb87d2a5cdab301b0dddd4e043c9ce2c49879c05f59ba88704aa4ffebb04b6eebb4c49e016f7998815236c8501b2100
-
Filesize
2.2MB
MD54a849d06d5a4d57ee8a254f1496fd971
SHA1c0240618d86b15e4647c700e07b3a794ac0d8c6d
SHA25627cf1af14a2922f4e05d20d8e522b5db515d61370c58a7226cd22815abf185b6
SHA512b4f6545f0ac01bf2e31a1591f0de994212ea2e7d17a7ab2a6a241118a63f594a46bd5dc496438119c38ac2984c606c654ea4e0aa57689cd03b67976569532f5d