Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 12:18
Behavioral task
behavioral1
Sample
cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
cf83d796d34e20a8b9e22ad4c51b00f9
-
SHA1
6d1d12e45369150e6c7eb4a5783bd55ca51ae7d4
-
SHA256
840bfe552b619bd154b7f542e02d1a9b13dc546bc0f9756249af44e2ce0cced6
-
SHA512
661944d20d542237776ab1c44d650f0d2f6e518f529f9d0978979a6967334e29317893686e7eb5e0ced50812ac7ebeea0dd0116a0ae50c863afdb282b0214d77
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWww3
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2248 explorer.exe 4808 explorer.exe 2728 spoolsv.exe 1200 spoolsv.exe 1248 spoolsv.exe 536 spoolsv.exe 640 spoolsv.exe 4520 spoolsv.exe 2704 spoolsv.exe 464 spoolsv.exe 3700 spoolsv.exe 232 spoolsv.exe 3248 spoolsv.exe 3692 spoolsv.exe 4860 spoolsv.exe 1640 spoolsv.exe 5012 spoolsv.exe 4692 spoolsv.exe 4456 spoolsv.exe 2796 spoolsv.exe 3452 spoolsv.exe 1504 spoolsv.exe 4592 spoolsv.exe 2236 spoolsv.exe 4368 spoolsv.exe 1344 spoolsv.exe 1660 spoolsv.exe 2052 spoolsv.exe 1784 spoolsv.exe 5060 spoolsv.exe 2988 explorer.exe 1080 spoolsv.exe 540 spoolsv.exe 3724 spoolsv.exe 2356 spoolsv.exe 4904 spoolsv.exe 1628 spoolsv.exe 4584 explorer.exe 5040 spoolsv.exe 708 spoolsv.exe 2684 spoolsv.exe 1400 spoolsv.exe 3436 explorer.exe 4632 spoolsv.exe 3768 spoolsv.exe 4448 spoolsv.exe 4848 spoolsv.exe 1516 spoolsv.exe 4764 spoolsv.exe 2472 explorer.exe 3188 spoolsv.exe 4304 spoolsv.exe 4396 spoolsv.exe 4484 spoolsv.exe 2468 spoolsv.exe 2540 explorer.exe 2008 spoolsv.exe 644 spoolsv.exe 4896 spoolsv.exe 1080 spoolsv.exe 4268 spoolsv.exe 3164 explorer.exe 2872 spoolsv.exe 4516 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 33 IoCs
description pid Process procid_target PID 1048 set thread context of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 2248 set thread context of 4808 2248 explorer.exe 100 PID 2728 set thread context of 5060 2728 spoolsv.exe 128 PID 1200 set thread context of 1080 1200 spoolsv.exe 130 PID 1248 set thread context of 3724 1248 spoolsv.exe 132 PID 536 set thread context of 2356 536 spoolsv.exe 133 PID 640 set thread context of 4904 640 spoolsv.exe 134 PID 4520 set thread context of 1628 4520 spoolsv.exe 135 PID 2704 set thread context of 5040 2704 spoolsv.exe 137 PID 464 set thread context of 2684 464 spoolsv.exe 139 PID 3700 set thread context of 1400 3700 spoolsv.exe 140 PID 232 set thread context of 4632 232 spoolsv.exe 142 PID 3248 set thread context of 4448 3248 spoolsv.exe 144 PID 3692 set thread context of 4848 3692 spoolsv.exe 145 PID 4860 set thread context of 4764 4860 spoolsv.exe 147 PID 1640 set thread context of 3188 1640 spoolsv.exe 149 PID 5012 set thread context of 4304 5012 spoolsv.exe 150 PID 4692 set thread context of 4396 4692 spoolsv.exe 151 PID 4456 set thread context of 2468 4456 spoolsv.exe 153 PID 2796 set thread context of 2008 2796 spoolsv.exe 155 PID 3452 set thread context of 644 3452 spoolsv.exe 156 PID 1504 set thread context of 4896 1504 spoolsv.exe 157 PID 4592 set thread context of 4268 4592 spoolsv.exe 159 PID 2236 set thread context of 2872 2236 spoolsv.exe 161 PID 4368 set thread context of 4516 4368 spoolsv.exe 162 PID 1344 set thread context of 2660 1344 spoolsv.exe 164 PID 1660 set thread context of 4420 1660 spoolsv.exe 166 PID 2052 set thread context of 3616 2052 spoolsv.exe 167 PID 1784 set thread context of 3088 1784 spoolsv.exe 171 PID 2988 set thread context of 3952 2988 explorer.exe 175 PID 540 set thread context of 4612 540 spoolsv.exe 177 PID 4584 set thread context of 4216 4584 explorer.exe 180 PID 708 set thread context of 2884 708 spoolsv.exe 183 -
Drops file in Windows directory 56 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 5060 spoolsv.exe 5060 spoolsv.exe 1080 spoolsv.exe 1080 spoolsv.exe 3724 spoolsv.exe 3724 spoolsv.exe 2356 spoolsv.exe 2356 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 1628 spoolsv.exe 1628 spoolsv.exe 5040 spoolsv.exe 5040 spoolsv.exe 2684 spoolsv.exe 2684 spoolsv.exe 1400 spoolsv.exe 1400 spoolsv.exe 4632 spoolsv.exe 4632 spoolsv.exe 4448 spoolsv.exe 4448 spoolsv.exe 4848 spoolsv.exe 4848 spoolsv.exe 4764 spoolsv.exe 4764 spoolsv.exe 3188 spoolsv.exe 3188 spoolsv.exe 4304 spoolsv.exe 4304 spoolsv.exe 4396 spoolsv.exe 4396 spoolsv.exe 2468 spoolsv.exe 2468 spoolsv.exe 2008 spoolsv.exe 2008 spoolsv.exe 644 spoolsv.exe 644 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 4268 spoolsv.exe 4268 spoolsv.exe 2872 spoolsv.exe 2872 spoolsv.exe 4516 spoolsv.exe 4516 spoolsv.exe 2660 spoolsv.exe 2660 spoolsv.exe 4420 spoolsv.exe 4420 spoolsv.exe 3616 spoolsv.exe 3616 spoolsv.exe 3088 spoolsv.exe 3088 spoolsv.exe 3952 explorer.exe 3952 explorer.exe 4612 spoolsv.exe 4612 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4628 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 83 PID 1048 wrote to memory of 4628 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 83 PID 1048 wrote to memory of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 1048 wrote to memory of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 1048 wrote to memory of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 1048 wrote to memory of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 1048 wrote to memory of 1296 1048 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 96 PID 1296 wrote to memory of 2248 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 97 PID 1296 wrote to memory of 2248 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 97 PID 1296 wrote to memory of 2248 1296 cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe 97 PID 2248 wrote to memory of 4808 2248 explorer.exe 100 PID 2248 wrote to memory of 4808 2248 explorer.exe 100 PID 2248 wrote to memory of 4808 2248 explorer.exe 100 PID 2248 wrote to memory of 4808 2248 explorer.exe 100 PID 2248 wrote to memory of 4808 2248 explorer.exe 100 PID 4808 wrote to memory of 2728 4808 explorer.exe 101 PID 4808 wrote to memory of 2728 4808 explorer.exe 101 PID 4808 wrote to memory of 2728 4808 explorer.exe 101 PID 4808 wrote to memory of 1200 4808 explorer.exe 102 PID 4808 wrote to memory of 1200 4808 explorer.exe 102 PID 4808 wrote to memory of 1200 4808 explorer.exe 102 PID 4808 wrote to memory of 1248 4808 explorer.exe 103 PID 4808 wrote to memory of 1248 4808 explorer.exe 103 PID 4808 wrote to memory of 1248 4808 explorer.exe 103 PID 4808 wrote to memory of 536 4808 explorer.exe 104 PID 4808 wrote to memory of 536 4808 explorer.exe 104 PID 4808 wrote to memory of 536 4808 explorer.exe 104 PID 4808 wrote to memory of 640 4808 explorer.exe 105 PID 4808 wrote to memory of 640 4808 explorer.exe 105 PID 4808 wrote to memory of 640 4808 explorer.exe 105 PID 4808 wrote to memory of 4520 4808 explorer.exe 106 PID 4808 wrote to memory of 4520 4808 explorer.exe 106 PID 4808 wrote to memory of 4520 4808 explorer.exe 106 PID 4808 wrote to memory of 2704 4808 explorer.exe 107 PID 4808 wrote to memory of 2704 4808 explorer.exe 107 PID 4808 wrote to memory of 2704 4808 explorer.exe 107 PID 4808 wrote to memory of 464 4808 explorer.exe 108 PID 4808 wrote to memory of 464 4808 explorer.exe 108 PID 4808 wrote to memory of 464 4808 explorer.exe 108 PID 4808 wrote to memory of 3700 4808 explorer.exe 109 PID 4808 wrote to memory of 3700 4808 explorer.exe 109 PID 4808 wrote to memory of 3700 4808 explorer.exe 109 PID 4808 wrote to memory of 232 4808 explorer.exe 110 PID 4808 wrote to memory of 232 4808 explorer.exe 110 PID 4808 wrote to memory of 232 4808 explorer.exe 110 PID 4808 wrote to memory of 3248 4808 explorer.exe 111 PID 4808 wrote to memory of 3248 4808 explorer.exe 111 PID 4808 wrote to memory of 3248 4808 explorer.exe 111 PID 4808 wrote to memory of 3692 4808 explorer.exe 112 PID 4808 wrote to memory of 3692 4808 explorer.exe 112 PID 4808 wrote to memory of 3692 4808 explorer.exe 112 PID 4808 wrote to memory of 4860 4808 explorer.exe 113 PID 4808 wrote to memory of 4860 4808 explorer.exe 113 PID 4808 wrote to memory of 4860 4808 explorer.exe 113 PID 4808 wrote to memory of 1640 4808 explorer.exe 114 PID 4808 wrote to memory of 1640 4808 explorer.exe 114 PID 4808 wrote to memory of 1640 4808 explorer.exe 114 PID 4808 wrote to memory of 5012 4808 explorer.exe 115 PID 4808 wrote to memory of 5012 4808 explorer.exe 115 PID 4808 wrote to memory of 5012 4808 explorer.exe 115 PID 4808 wrote to memory of 4692 4808 explorer.exe 116 PID 4808 wrote to memory of 4692 4808 explorer.exe 116 PID 4808 wrote to memory of 4692 4808 explorer.exe 116 PID 4808 wrote to memory of 4456 4808 explorer.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf83d796d34e20a8b9e22ad4c51b00f9_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5060 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2988 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3724
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2356
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4584 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4216
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1400 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3436 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1668
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4448
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2472 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4540
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2468 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4848
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:644
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4268 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3164 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2788
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2660 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1300
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3088 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1456
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1792
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2252
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3768 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3940
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2932
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2816
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2140
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4324
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2664
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1012
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:744
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1104 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4744
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:900
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2068
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3220
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2476
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2748
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2700
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1072
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1408
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4528
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5cf1305c447b63935476e86fc10cbcc21
SHA1246dc92962fa665256f338c320ab686a4a7b6adc
SHA25674fb2de8e36ed19316c839966b6ffb24aac483b66473cfe89722b621511d1bcd
SHA5126375622ef3e3273c22f49d9d3145dabc4c00e0e2f889ad7f790fb627807f8139a4f9d47ee4f515684a5996fcbfa9de32f179683e09b9341fed69bd20e77aa733
-
Filesize
2.2MB
MD51d4bf21d24ebf38319cbc851f8c0087b
SHA13417590d92b50fc3f3dcd6cbe1d1892566ec005d
SHA256f84302077b2cb2406cd41c40ace650c927abeb83589265da239240479d393930
SHA512dca54b71cb8a98ccff446e44e4dbe4f9f2c47203ed5a815ec6e842d2f64b17c88988e04f1bf74db85dd5604d3dd6335923b63e8b3d60031959d861c7746565a5