Analysis
-
max time kernel
147s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 19:16
Behavioral task
behavioral1
Sample
b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4c40aa7112083f19750bca5a5a869a2
-
SHA1
0caa973d2ce6db163c4a43bfc4d38aabfe8a5fa6
-
SHA256
f5426ca04c4e6dcaa1224553809fa2b5bc73e35248311cf8e7af0ca35d3fbdbb
-
SHA512
c1ea86abb360a693789b9f4774ca725d90bebc3ddf7f470d528e318c65b84d6e09d3cbd048fea340277447891ba7cfd0a8db8163a7bb64c942d4f87f966eeeee
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwv
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4952 explorer.exe 3068 explorer.exe 1280 spoolsv.exe 1852 spoolsv.exe 4224 spoolsv.exe 1536 spoolsv.exe 792 spoolsv.exe 112 spoolsv.exe 3720 spoolsv.exe 2188 spoolsv.exe 3592 spoolsv.exe 528 spoolsv.exe 4352 spoolsv.exe 1820 spoolsv.exe 1456 spoolsv.exe 4460 spoolsv.exe 2140 spoolsv.exe 184 spoolsv.exe 3980 spoolsv.exe 5116 spoolsv.exe 2068 spoolsv.exe 2160 spoolsv.exe 2592 spoolsv.exe 688 spoolsv.exe 3440 spoolsv.exe 8 spoolsv.exe 2816 spoolsv.exe 3044 spoolsv.exe 336 spoolsv.exe 3876 spoolsv.exe 2216 spoolsv.exe 3648 spoolsv.exe 3504 spoolsv.exe 4268 explorer.exe 3332 spoolsv.exe 2588 spoolsv.exe 1408 spoolsv.exe 4816 spoolsv.exe 896 explorer.exe 3480 spoolsv.exe 4608 spoolsv.exe 2124 spoolsv.exe 3312 spoolsv.exe 1792 spoolsv.exe 3972 spoolsv.exe 4452 explorer.exe 4756 spoolsv.exe 2424 spoolsv.exe 3688 spoolsv.exe 1388 spoolsv.exe 524 spoolsv.exe 3656 explorer.exe 1904 spoolsv.exe 4112 spoolsv.exe 4548 spoolsv.exe 1400 spoolsv.exe 1568 spoolsv.exe 880 explorer.exe 1888 spoolsv.exe 2144 spoolsv.exe 3576 spoolsv.exe 3400 spoolsv.exe 1492 spoolsv.exe 1092 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
description pid Process procid_target PID 1456 set thread context of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 4952 set thread context of 3068 4952 explorer.exe 91 PID 1280 set thread context of 3504 1280 spoolsv.exe 122 PID 1852 set thread context of 3332 1852 spoolsv.exe 124 PID 4224 set thread context of 2588 4224 spoolsv.exe 125 PID 1536 set thread context of 4816 1536 spoolsv.exe 127 PID 792 set thread context of 3480 792 spoolsv.exe 129 PID 112 set thread context of 4608 112 spoolsv.exe 130 PID 3720 set thread context of 2124 3720 spoolsv.exe 131 PID 2188 set thread context of 3312 2188 spoolsv.exe 132 PID 3592 set thread context of 3972 3592 spoolsv.exe 134 PID 528 set thread context of 4756 528 spoolsv.exe 136 PID 4352 set thread context of 2424 4352 spoolsv.exe 137 PID 1820 set thread context of 3688 1820 spoolsv.exe 138 PID 1456 set thread context of 524 1456 spoolsv.exe 140 PID 4460 set thread context of 1904 4460 spoolsv.exe 142 PID 2140 set thread context of 4112 2140 spoolsv.exe 143 PID 184 set thread context of 4548 184 spoolsv.exe 144 PID 3980 set thread context of 1568 3980 spoolsv.exe 146 PID 5116 set thread context of 1888 5116 spoolsv.exe 148 PID 2068 set thread context of 2144 2068 spoolsv.exe 149 PID 2160 set thread context of 3576 2160 spoolsv.exe 150 PID 2592 set thread context of 1492 2592 spoolsv.exe 152 PID 688 set thread context of 1092 688 spoolsv.exe 153 PID 3440 set thread context of 2988 3440 spoolsv.exe 155 PID 8 set thread context of 2296 8 spoolsv.exe 156 PID 2816 set thread context of 3788 2816 spoolsv.exe 157 PID 3044 set thread context of 2236 3044 spoolsv.exe 159 PID 336 set thread context of 1644 336 spoolsv.exe 161 PID 3876 set thread context of 2768 3876 spoolsv.exe 162 PID 2216 set thread context of 4940 2216 spoolsv.exe 164 PID 3648 set thread context of 3744 3648 spoolsv.exe 168 PID 4268 set thread context of 3904 4268 explorer.exe 170 PID 1408 set thread context of 4520 1408 spoolsv.exe 172 PID 896 set thread context of 1784 896 explorer.exe 174 PID 4452 set thread context of 636 4452 explorer.exe 177 PID 1792 set thread context of 3700 1792 spoolsv.exe 178 PID 1388 set thread context of 4648 1388 spoolsv.exe 183 PID 3656 set thread context of 3240 3656 explorer.exe 185 PID 880 set thread context of 3912 880 explorer.exe 191 PID 3400 set thread context of 4552 3400 spoolsv.exe 195 PID 2476 set thread context of 4876 2476 explorer.exe 197 PID 452 set thread context of 2064 452 spoolsv.exe 200 PID 2072 set thread context of 1320 2072 explorer.exe 202 PID 756 set thread context of 4396 756 explorer.exe 203 PID 2100 set thread context of 2532 2100 spoolsv.exe 204 PID 3168 set thread context of 5100 3168 spoolsv.exe 205 PID 976 set thread context of 4824 976 spoolsv.exe 208 PID 3336 set thread context of 1140 3336 explorer.exe 211 PID 928 set thread context of 2104 928 spoolsv.exe 213 PID 2924 set thread context of 1300 2924 explorer.exe 215 PID 1148 set thread context of 1576 1148 spoolsv.exe 216 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3068 explorer.exe 3504 spoolsv.exe 3504 spoolsv.exe 3332 spoolsv.exe 3332 spoolsv.exe 2588 spoolsv.exe 2588 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 3480 spoolsv.exe 3480 spoolsv.exe 4608 spoolsv.exe 4608 spoolsv.exe 2124 spoolsv.exe 2124 spoolsv.exe 3312 spoolsv.exe 3312 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 4756 spoolsv.exe 4756 spoolsv.exe 2424 spoolsv.exe 2424 spoolsv.exe 3688 spoolsv.exe 3688 spoolsv.exe 524 spoolsv.exe 524 spoolsv.exe 1904 spoolsv.exe 1904 spoolsv.exe 4112 spoolsv.exe 4112 spoolsv.exe 4548 spoolsv.exe 4548 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 1888 spoolsv.exe 1888 spoolsv.exe 2144 spoolsv.exe 2144 spoolsv.exe 3576 spoolsv.exe 3576 spoolsv.exe 1492 spoolsv.exe 1492 spoolsv.exe 1092 spoolsv.exe 1092 spoolsv.exe 2988 spoolsv.exe 2988 spoolsv.exe 2296 spoolsv.exe 2296 spoolsv.exe 3788 spoolsv.exe 3788 spoolsv.exe 2236 spoolsv.exe 2236 spoolsv.exe 1644 spoolsv.exe 1644 spoolsv.exe 2768 spoolsv.exe 2768 spoolsv.exe 4940 spoolsv.exe 4940 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1456 wrote to memory of 4356 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 80 PID 1456 wrote to memory of 4356 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 80 PID 1456 wrote to memory of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 1456 wrote to memory of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 1456 wrote to memory of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 1456 wrote to memory of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 1456 wrote to memory of 1988 1456 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 82 PID 1988 wrote to memory of 4952 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 83 PID 1988 wrote to memory of 4952 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 83 PID 1988 wrote to memory of 4952 1988 b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe 83 PID 4952 wrote to memory of 3068 4952 explorer.exe 91 PID 4952 wrote to memory of 3068 4952 explorer.exe 91 PID 4952 wrote to memory of 3068 4952 explorer.exe 91 PID 4952 wrote to memory of 3068 4952 explorer.exe 91 PID 4952 wrote to memory of 3068 4952 explorer.exe 91 PID 3068 wrote to memory of 1280 3068 explorer.exe 92 PID 3068 wrote to memory of 1280 3068 explorer.exe 92 PID 3068 wrote to memory of 1280 3068 explorer.exe 92 PID 3068 wrote to memory of 1852 3068 explorer.exe 93 PID 3068 wrote to memory of 1852 3068 explorer.exe 93 PID 3068 wrote to memory of 1852 3068 explorer.exe 93 PID 3068 wrote to memory of 4224 3068 explorer.exe 94 PID 3068 wrote to memory of 4224 3068 explorer.exe 94 PID 3068 wrote to memory of 4224 3068 explorer.exe 94 PID 3068 wrote to memory of 1536 3068 explorer.exe 95 PID 3068 wrote to memory of 1536 3068 explorer.exe 95 PID 3068 wrote to memory of 1536 3068 explorer.exe 95 PID 3068 wrote to memory of 792 3068 explorer.exe 96 PID 3068 wrote to memory of 792 3068 explorer.exe 96 PID 3068 wrote to memory of 792 3068 explorer.exe 96 PID 3068 wrote to memory of 112 3068 explorer.exe 97 PID 3068 wrote to memory of 112 3068 explorer.exe 97 PID 3068 wrote to memory of 112 3068 explorer.exe 97 PID 3068 wrote to memory of 3720 3068 explorer.exe 98 PID 3068 wrote to memory of 3720 3068 explorer.exe 98 PID 3068 wrote to memory of 3720 3068 explorer.exe 98 PID 3068 wrote to memory of 2188 3068 explorer.exe 99 PID 3068 wrote to memory of 2188 3068 explorer.exe 99 PID 3068 wrote to memory of 2188 3068 explorer.exe 99 PID 3068 wrote to memory of 3592 3068 explorer.exe 100 PID 3068 wrote to memory of 3592 3068 explorer.exe 100 PID 3068 wrote to memory of 3592 3068 explorer.exe 100 PID 3068 wrote to memory of 528 3068 explorer.exe 101 PID 3068 wrote to memory of 528 3068 explorer.exe 101 PID 3068 wrote to memory of 528 3068 explorer.exe 101 PID 3068 wrote to memory of 4352 3068 explorer.exe 102 PID 3068 wrote to memory of 4352 3068 explorer.exe 102 PID 3068 wrote to memory of 4352 3068 explorer.exe 102 PID 3068 wrote to memory of 1820 3068 explorer.exe 103 PID 3068 wrote to memory of 1820 3068 explorer.exe 103 PID 3068 wrote to memory of 1820 3068 explorer.exe 103 PID 3068 wrote to memory of 1456 3068 explorer.exe 104 PID 3068 wrote to memory of 1456 3068 explorer.exe 104 PID 3068 wrote to memory of 1456 3068 explorer.exe 104 PID 3068 wrote to memory of 4460 3068 explorer.exe 105 PID 3068 wrote to memory of 4460 3068 explorer.exe 105 PID 3068 wrote to memory of 4460 3068 explorer.exe 105 PID 3068 wrote to memory of 2140 3068 explorer.exe 106 PID 3068 wrote to memory of 2140 3068 explorer.exe 106 PID 3068 wrote to memory of 2140 3068 explorer.exe 106 PID 3068 wrote to memory of 184 3068 explorer.exe 107 PID 3068 wrote to memory of 184 3068 explorer.exe 107 PID 3068 wrote to memory of 184 3068 explorer.exe 107 PID 3068 wrote to memory of 3980 3068 explorer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4c40aa7112083f19750bca5a5a869a2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3504 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4268 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3904
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:896 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1784
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2188 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3972 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4756
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1820 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:524 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3656 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3240
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:880 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3912
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1492
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2476 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4876
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:8 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2236 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2072 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1320
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4940 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:756 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4396
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3744
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3336 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1140
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4520
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2924 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1300
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3700
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1872
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4648
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1056
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:1400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1412
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4244
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4552
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4828
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2064
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4688
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2532
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4824
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2676
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2104
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3968
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:448
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4964
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1696
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1436
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4652
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1800
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD594826611e2573458fcaf1889f54960c1
SHA1245997b4f067c0b903263625f0e092537ec0aaed
SHA256da145f77a817142cd36b94668796973423582e422a2b9fa49e86e718ac1f8210
SHA51282d7f98e00132af13256e0b00768252a259f425278d05f61d4070af7033837d9976ba5d49d61c733cb0848327e1ec91f3f6066d64cffa571b0eceebdf96781a8
-
Filesize
2.2MB
MD555f394b2185a721b8ea4acb0f0f84b93
SHA100972fdd419cafa5e026d513c8e2efad60bd7c00
SHA256cc99561246f74c8aec112fcfe174729822ef4f9bcc5e6fc074926ced947701af
SHA512c1d0e29bb11a73456c8b1e3ab0ce7dd9c7f28bd1f148a1a426df9e9b2f3571944a74c8588ac8c60e176aaf3b66e1e485e6194d89765cc2d6d6e04302c7f32090