Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 04:08
Behavioral task
behavioral1
Sample
b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b6aea7b6be2d50707989005b8ee5e845
-
SHA1
e0bb26d8494c174d5d9dfca48cd693b623071b81
-
SHA256
ea43c5a3714f2f1839a4bac9d4dae59aa64ceafc6b108a0e11cf16d74dd8c6dc
-
SHA512
318947ee97bfdbccd5bdfacceac7abc1aabc372f9db761e75dbb64bc5969e4ca4cf44253eb8bf026e002025de1d20db6c61c05aebceacf70790a601a2068f187
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZO:0UzeyQMS4DqodCnoe+iitjWwwK
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1328 explorer.exe 928 explorer.exe 1516 spoolsv.exe 3980 spoolsv.exe 3808 spoolsv.exe 4448 spoolsv.exe 4036 spoolsv.exe 4172 spoolsv.exe 1616 spoolsv.exe 1480 spoolsv.exe 2044 spoolsv.exe 956 spoolsv.exe 1484 spoolsv.exe 2764 spoolsv.exe 3312 spoolsv.exe 3576 spoolsv.exe 1452 spoolsv.exe 772 spoolsv.exe 3368 spoolsv.exe 4864 spoolsv.exe 2272 spoolsv.exe 4136 spoolsv.exe 4812 spoolsv.exe 1080 spoolsv.exe 2212 spoolsv.exe 4384 spoolsv.exe 4352 spoolsv.exe 4852 spoolsv.exe 4808 spoolsv.exe 456 spoolsv.exe 4556 explorer.exe 1592 spoolsv.exe 4920 spoolsv.exe 1872 spoolsv.exe 1716 spoolsv.exe 1476 spoolsv.exe 2864 explorer.exe 4112 spoolsv.exe 2896 spoolsv.exe 2564 spoolsv.exe 624 spoolsv.exe 1984 explorer.exe 2420 spoolsv.exe 4652 spoolsv.exe 220 spoolsv.exe 4044 spoolsv.exe 452 explorer.exe 4560 spoolsv.exe 2980 spoolsv.exe 2316 spoolsv.exe 3840 spoolsv.exe 2792 explorer.exe 3508 spoolsv.exe 4152 spoolsv.exe 2208 spoolsv.exe 2076 spoolsv.exe 5068 spoolsv.exe 3544 explorer.exe 2356 spoolsv.exe 3356 spoolsv.exe 1528 spoolsv.exe 3880 spoolsv.exe 4680 explorer.exe 324 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 38 IoCs
description pid Process procid_target PID 1408 set thread context of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 1328 set thread context of 928 1328 explorer.exe 91 PID 1516 set thread context of 456 1516 spoolsv.exe 119 PID 3980 set thread context of 1592 3980 spoolsv.exe 121 PID 3808 set thread context of 4920 3808 spoolsv.exe 122 PID 4448 set thread context of 1872 4448 spoolsv.exe 124 PID 4036 set thread context of 1476 4036 spoolsv.exe 125 PID 4172 set thread context of 4112 4172 spoolsv.exe 127 PID 1616 set thread context of 2896 1616 spoolsv.exe 128 PID 1480 set thread context of 624 1480 spoolsv.exe 130 PID 2044 set thread context of 2420 2044 spoolsv.exe 132 PID 956 set thread context of 4652 956 spoolsv.exe 133 PID 1484 set thread context of 4044 1484 spoolsv.exe 135 PID 2764 set thread context of 4560 2764 spoolsv.exe 137 PID 3312 set thread context of 2980 3312 spoolsv.exe 138 PID 3576 set thread context of 3840 3576 spoolsv.exe 140 PID 1452 set thread context of 3508 1452 spoolsv.exe 142 PID 772 set thread context of 4152 772 spoolsv.exe 143 PID 3368 set thread context of 2076 3368 spoolsv.exe 145 PID 4864 set thread context of 5068 4864 spoolsv.exe 146 PID 2272 set thread context of 2356 2272 spoolsv.exe 148 PID 4136 set thread context of 1528 4136 spoolsv.exe 150 PID 4812 set thread context of 3880 4812 spoolsv.exe 151 PID 1080 set thread context of 324 1080 spoolsv.exe 153 PID 2212 set thread context of 628 2212 spoolsv.exe 154 PID 4384 set thread context of 2020 4384 spoolsv.exe 156 PID 4352 set thread context of 4620 4352 spoolsv.exe 157 PID 4852 set thread context of 1332 4852 spoolsv.exe 159 PID 4808 set thread context of 1900 4808 spoolsv.exe 163 PID 4556 set thread context of 1568 4556 explorer.exe 165 PID 1716 set thread context of 2856 1716 spoolsv.exe 168 PID 2864 set thread context of 5080 2864 explorer.exe 170 PID 2564 set thread context of 864 2564 spoolsv.exe 172 PID 1984 set thread context of 3692 1984 explorer.exe 175 PID 220 set thread context of 4220 220 spoolsv.exe 178 PID 452 set thread context of 2948 452 explorer.exe 180 PID 2316 set thread context of 4964 2316 spoolsv.exe 183 PID 2792 set thread context of 4868 2792 explorer.exe 185 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 928 explorer.exe 456 spoolsv.exe 456 spoolsv.exe 1592 spoolsv.exe 1592 spoolsv.exe 4920 spoolsv.exe 4920 spoolsv.exe 1872 spoolsv.exe 1872 spoolsv.exe 1476 spoolsv.exe 1476 spoolsv.exe 4112 spoolsv.exe 4112 spoolsv.exe 2896 spoolsv.exe 2896 spoolsv.exe 624 spoolsv.exe 624 spoolsv.exe 2420 spoolsv.exe 2420 spoolsv.exe 4652 spoolsv.exe 4652 spoolsv.exe 4044 spoolsv.exe 4044 spoolsv.exe 4560 spoolsv.exe 4560 spoolsv.exe 2980 spoolsv.exe 2980 spoolsv.exe 3840 spoolsv.exe 3840 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 4152 spoolsv.exe 4152 spoolsv.exe 2076 spoolsv.exe 2076 spoolsv.exe 5068 spoolsv.exe 5068 spoolsv.exe 2356 spoolsv.exe 2356 spoolsv.exe 1528 spoolsv.exe 1528 spoolsv.exe 3880 spoolsv.exe 3880 spoolsv.exe 324 spoolsv.exe 324 spoolsv.exe 628 spoolsv.exe 628 spoolsv.exe 2020 spoolsv.exe 2020 spoolsv.exe 4620 spoolsv.exe 4620 spoolsv.exe 1332 spoolsv.exe 1332 spoolsv.exe 1900 spoolsv.exe 1900 spoolsv.exe 1568 explorer.exe 1568 explorer.exe 2856 spoolsv.exe 2856 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 3748 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 81 PID 1408 wrote to memory of 3748 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 81 PID 1408 wrote to memory of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 1408 wrote to memory of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 1408 wrote to memory of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 1408 wrote to memory of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 1408 wrote to memory of 4368 1408 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 86 PID 4368 wrote to memory of 1328 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 87 PID 4368 wrote to memory of 1328 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 87 PID 4368 wrote to memory of 1328 4368 b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe 87 PID 1328 wrote to memory of 928 1328 explorer.exe 91 PID 1328 wrote to memory of 928 1328 explorer.exe 91 PID 1328 wrote to memory of 928 1328 explorer.exe 91 PID 1328 wrote to memory of 928 1328 explorer.exe 91 PID 1328 wrote to memory of 928 1328 explorer.exe 91 PID 928 wrote to memory of 1516 928 explorer.exe 92 PID 928 wrote to memory of 1516 928 explorer.exe 92 PID 928 wrote to memory of 1516 928 explorer.exe 92 PID 928 wrote to memory of 3980 928 explorer.exe 93 PID 928 wrote to memory of 3980 928 explorer.exe 93 PID 928 wrote to memory of 3980 928 explorer.exe 93 PID 928 wrote to memory of 3808 928 explorer.exe 94 PID 928 wrote to memory of 3808 928 explorer.exe 94 PID 928 wrote to memory of 3808 928 explorer.exe 94 PID 928 wrote to memory of 4448 928 explorer.exe 95 PID 928 wrote to memory of 4448 928 explorer.exe 95 PID 928 wrote to memory of 4448 928 explorer.exe 95 PID 928 wrote to memory of 4036 928 explorer.exe 96 PID 928 wrote to memory of 4036 928 explorer.exe 96 PID 928 wrote to memory of 4036 928 explorer.exe 96 PID 928 wrote to memory of 4172 928 explorer.exe 97 PID 928 wrote to memory of 4172 928 explorer.exe 97 PID 928 wrote to memory of 4172 928 explorer.exe 97 PID 928 wrote to memory of 1616 928 explorer.exe 98 PID 928 wrote to memory of 1616 928 explorer.exe 98 PID 928 wrote to memory of 1616 928 explorer.exe 98 PID 928 wrote to memory of 1480 928 explorer.exe 99 PID 928 wrote to memory of 1480 928 explorer.exe 99 PID 928 wrote to memory of 1480 928 explorer.exe 99 PID 928 wrote to memory of 2044 928 explorer.exe 100 PID 928 wrote to memory of 2044 928 explorer.exe 100 PID 928 wrote to memory of 2044 928 explorer.exe 100 PID 928 wrote to memory of 956 928 explorer.exe 101 PID 928 wrote to memory of 956 928 explorer.exe 101 PID 928 wrote to memory of 956 928 explorer.exe 101 PID 928 wrote to memory of 1484 928 explorer.exe 102 PID 928 wrote to memory of 1484 928 explorer.exe 102 PID 928 wrote to memory of 1484 928 explorer.exe 102 PID 928 wrote to memory of 2764 928 explorer.exe 103 PID 928 wrote to memory of 2764 928 explorer.exe 103 PID 928 wrote to memory of 2764 928 explorer.exe 103 PID 928 wrote to memory of 3312 928 explorer.exe 104 PID 928 wrote to memory of 3312 928 explorer.exe 104 PID 928 wrote to memory of 3312 928 explorer.exe 104 PID 928 wrote to memory of 3576 928 explorer.exe 105 PID 928 wrote to memory of 3576 928 explorer.exe 105 PID 928 wrote to memory of 3576 928 explorer.exe 105 PID 928 wrote to memory of 1452 928 explorer.exe 106 PID 928 wrote to memory of 1452 928 explorer.exe 106 PID 928 wrote to memory of 1452 928 explorer.exe 106 PID 928 wrote to memory of 772 928 explorer.exe 107 PID 928 wrote to memory of 772 928 explorer.exe 107 PID 928 wrote to memory of 772 928 explorer.exe 107 PID 928 wrote to memory of 3368 928 explorer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b6aea7b6be2d50707989005b8ee5e845_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:456 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2864 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5080
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1984 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3692
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4044 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2948
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3840 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2792 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4868
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4152
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5068 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3544 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3912
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2356
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3880 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4680 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:432
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:628
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4384 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4620 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4228
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1900 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2668 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1848
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1716 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2856 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3932 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5056
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:864
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:916
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4220
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:368
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4964
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2248
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:548
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3952
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4956
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4488
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4424
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4436
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1748
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4024
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1492
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:468
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4648
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1264
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1768
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2352
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4816
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:384
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3996
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1404
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1864
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4388
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:436
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5c7f7b70394adebcb6eb217822dc34b04
SHA18641f3f0d189dcc560757d105c78a0fe7f1352d8
SHA256ab95d8b42ff116dc6563fb785926e927bb05fae20caf99fac4aeb106b1f64fc7
SHA51256154735ad13b938ee18cbb6420b79423cbf3c9aec2efcf1a2db6c5c5840ba2fb97c192097e7965431e743a8ffb0386063eb3c3d99eafc08e4b29a4f8d8f0c3e
-
Filesize
2.2MB
MD54d2f5822a01378874298b54fc0f5ee5c
SHA1b3872835075e8e0de39b0c47bcacb06fb1624746
SHA256c0179cb62e929060d5de41c8f96b7ec99de5b363c6b4f83c4d3a3d95a0c082a2
SHA5123acff7a454229179d3ecea37cd76ade3714ec389b06887def30657233f5c526a080fd2c1464e0a620866cb139f1bbab744d5d144a33fce0f6c1d595c32526d7c