Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 18:45
Behavioral task
behavioral1
Sample
b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4a556ab0e95ad48c81ad37c96ecbd0e
-
SHA1
45067217c2eef2426e796e9c1a2d2ef5ea6b15cb
-
SHA256
cd244999f3e0ce46ab40da3b70de9cbf43a934dcd123b19bd2c612691db2e237
-
SHA512
acc25ba6a4492e0aa0739c872bd98f5c0c2a4b228e75e3aaa56098c6b0c9b454c98fed8f7b4377cd7d527664b547b29b30f90eb3c1a2d352da7571e59bf47390
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwI
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2440 explorer.exe 2292 explorer.exe 1560 spoolsv.exe 1240 spoolsv.exe 2180 spoolsv.exe 3068 spoolsv.exe 1672 spoolsv.exe 2236 spoolsv.exe 2480 spoolsv.exe 2816 spoolsv.exe 2988 spoolsv.exe 2008 spoolsv.exe 876 spoolsv.exe 1096 spoolsv.exe 1580 spoolsv.exe 880 spoolsv.exe 2124 spoolsv.exe 2360 spoolsv.exe 2672 spoolsv.exe 864 spoolsv.exe 2732 spoolsv.exe 1128 spoolsv.exe 572 spoolsv.exe 1992 spoolsv.exe 2632 spoolsv.exe 2528 spoolsv.exe 1812 spoolsv.exe 2188 spoolsv.exe 2904 spoolsv.exe 904 spoolsv.exe 1536 spoolsv.exe 328 spoolsv.exe 2684 spoolsv.exe 2100 spoolsv.exe 2240 spoolsv.exe 1632 spoolsv.exe 2564 spoolsv.exe 2832 spoolsv.exe 1688 spoolsv.exe 1404 spoolsv.exe 2196 spoolsv.exe 2720 spoolsv.exe 2396 spoolsv.exe 1332 spoolsv.exe 1664 spoolsv.exe 2752 spoolsv.exe 2820 spoolsv.exe 1684 spoolsv.exe 1744 spoolsv.exe 1960 spoolsv.exe 2408 spoolsv.exe 1692 spoolsv.exe 320 spoolsv.exe 2388 spoolsv.exe 1828 spoolsv.exe 1928 spoolsv.exe 2260 spoolsv.exe 1548 spoolsv.exe 344 spoolsv.exe 2364 spoolsv.exe 1564 spoolsv.exe 2448 spoolsv.exe 672 spoolsv.exe 2272 spoolsv.exe -
Loads dropped DLL 64 IoCs
pid Process 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1904 set thread context of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 2440 set thread context of 2292 2440 explorer.exe 33 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2292 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe 2292 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2872 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2872 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2872 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 28 PID 1904 wrote to memory of 2872 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 28 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1904 wrote to memory of 1940 1904 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 29 PID 1940 wrote to memory of 2440 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2440 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2440 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 30 PID 1940 wrote to memory of 2440 1940 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 30 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2440 wrote to memory of 2292 2440 explorer.exe 33 PID 2292 wrote to memory of 1560 2292 explorer.exe 34 PID 2292 wrote to memory of 1560 2292 explorer.exe 34 PID 2292 wrote to memory of 1560 2292 explorer.exe 34 PID 2292 wrote to memory of 1560 2292 explorer.exe 34 PID 2292 wrote to memory of 1240 2292 explorer.exe 35 PID 2292 wrote to memory of 1240 2292 explorer.exe 35 PID 2292 wrote to memory of 1240 2292 explorer.exe 35 PID 2292 wrote to memory of 1240 2292 explorer.exe 35 PID 2292 wrote to memory of 2180 2292 explorer.exe 36 PID 2292 wrote to memory of 2180 2292 explorer.exe 36 PID 2292 wrote to memory of 2180 2292 explorer.exe 36 PID 2292 wrote to memory of 2180 2292 explorer.exe 36 PID 2292 wrote to memory of 3068 2292 explorer.exe 37 PID 2292 wrote to memory of 3068 2292 explorer.exe 37 PID 2292 wrote to memory of 3068 2292 explorer.exe 37 PID 2292 wrote to memory of 3068 2292 explorer.exe 37 PID 2292 wrote to memory of 1672 2292 explorer.exe 38 PID 2292 wrote to memory of 1672 2292 explorer.exe 38 PID 2292 wrote to memory of 1672 2292 explorer.exe 38 PID 2292 wrote to memory of 1672 2292 explorer.exe 38 PID 2292 wrote to memory of 2236 2292 explorer.exe 39 PID 2292 wrote to memory of 2236 2292 explorer.exe 39 PID 2292 wrote to memory of 2236 2292 explorer.exe 39 PID 2292 wrote to memory of 2236 2292 explorer.exe 39 PID 2292 wrote to memory of 2480 2292 explorer.exe 40 PID 2292 wrote to memory of 2480 2292 explorer.exe 40 PID 2292 wrote to memory of 2480 2292 explorer.exe 40 PID 2292 wrote to memory of 2480 2292 explorer.exe 40 PID 2292 wrote to memory of 2816 2292 explorer.exe 41 PID 2292 wrote to memory of 2816 2292 explorer.exe 41 PID 2292 wrote to memory of 2816 2292 explorer.exe 41 PID 2292 wrote to memory of 2816 2292 explorer.exe 41 PID 2292 wrote to memory of 2988 2292 explorer.exe 42 PID 2292 wrote to memory of 2988 2292 explorer.exe 42 PID 2292 wrote to memory of 2988 2292 explorer.exe 42 PID 2292 wrote to memory of 2988 2292 explorer.exe 42 PID 2292 wrote to memory of 2008 2292 explorer.exe 43 PID 2292 wrote to memory of 2008 2292 explorer.exe 43 PID 2292 wrote to memory of 2008 2292 explorer.exe 43 PID 2292 wrote to memory of 2008 2292 explorer.exe 43 PID 2292 wrote to memory of 876 2292 explorer.exe 44 PID 2292 wrote to memory of 876 2292 explorer.exe 44 PID 2292 wrote to memory of 876 2292 explorer.exe 44 PID 2292 wrote to memory of 876 2292 explorer.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4936
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5100
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1240 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1672 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1096
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1580
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2672
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2732
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2196
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1664
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:344
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:672
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1508
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2028
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3132
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3212
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3448
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3564
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3304
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3200
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3672
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:700
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3480
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3628
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3296
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4024
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3664
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2244
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4800
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4228
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4764
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4944
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4472
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4792
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5008
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4188
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4504
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4120
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4364
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6688
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6964
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5807365e0fe82d80a57dc4e0969942ab0
SHA16870c2acbe8d90c1b6f85ea40dd1fef8591ff68f
SHA2562a6db97aff6e0f9818d728de8cd5031fd6659fcb235edb7ce803bb93697c1b54
SHA512884f089339916a8779d4f98f8de9d6cbfa1e371f565ef639dff095e2dacd956731b09c60fa28d6e8cbc6059430145fc57912d9b4023ee8f99e6f07b089940ecc
-
Filesize
2.2MB
MD5a72f99c2ff2f3b0ca311f1f3dfa72216
SHA1eef518d60b1033956363a3948060f200490af6e0
SHA2562cce9e3c3eeb167cb545f031c502cbc256fecc51dceab82f7866743dc1d12b32
SHA512d7c03e58be756ea17d123bffc8b6201051c1d7ccaf0e508fb6a96962de7c66cd0346115da7840a289befdd0ebdefa3e81ce469957ec6dd43cffb30dc5ac0a3c0