Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 01:51
Behavioral task
behavioral1
Sample
d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
d0d4c25a8ce74749772b112963da7c16
-
SHA1
232a67841e1fc6a76faeafc08549c6ae617cbc8a
-
SHA256
3c0fd9cae1d1fa3a31af84a44ff19ee1eab025a3aa3e9d9dc2e22252c7a6a29b
-
SHA512
9b258833cc017584f984e51a6aa9fb3057ce2a7a88442bd863c075762ab61c9daa78bf3a198a4f6ec37a5ca6cae2e806d824fb1ec7d48ee4bfd219b650fb4631
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWwwh
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3440 explorer.exe 4236 explorer.exe 2508 spoolsv.exe 3356 spoolsv.exe 852 spoolsv.exe 1596 spoolsv.exe 3228 spoolsv.exe 4480 spoolsv.exe 1476 spoolsv.exe 3916 spoolsv.exe 856 spoolsv.exe 3668 spoolsv.exe 1536 spoolsv.exe 3348 spoolsv.exe 4332 spoolsv.exe 2620 spoolsv.exe 1984 spoolsv.exe 3612 spoolsv.exe 4144 spoolsv.exe 3244 spoolsv.exe 1684 spoolsv.exe 3680 spoolsv.exe 3088 spoolsv.exe 3724 spoolsv.exe 3068 spoolsv.exe 5036 spoolsv.exe 3336 spoolsv.exe 1072 spoolsv.exe 1280 spoolsv.exe 2392 spoolsv.exe 1344 spoolsv.exe 4928 explorer.exe 4792 spoolsv.exe 4976 spoolsv.exe 2368 spoolsv.exe 1320 spoolsv.exe 3400 spoolsv.exe 2072 explorer.exe 3520 spoolsv.exe 4900 spoolsv.exe 3688 spoolsv.exe 2460 spoolsv.exe 2196 spoolsv.exe 2616 spoolsv.exe 4724 explorer.exe 1788 spoolsv.exe 4956 spoolsv.exe 1952 spoolsv.exe 752 spoolsv.exe 212 explorer.exe 4648 spoolsv.exe 1972 spoolsv.exe 1372 spoolsv.exe 4464 spoolsv.exe 2176 spoolsv.exe 2144 explorer.exe 1132 spoolsv.exe 1300 spoolsv.exe 4732 spoolsv.exe 4712 spoolsv.exe 4500 spoolsv.exe 3756 explorer.exe 3284 spoolsv.exe 1540 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 38 IoCs
description pid Process procid_target PID 868 set thread context of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 3440 set thread context of 4236 3440 explorer.exe 98 PID 2508 set thread context of 1344 2508 spoolsv.exe 127 PID 3356 set thread context of 4792 3356 spoolsv.exe 129 PID 852 set thread context of 2368 852 spoolsv.exe 131 PID 1596 set thread context of 1320 1596 spoolsv.exe 132 PID 3228 set thread context of 3400 3228 spoolsv.exe 133 PID 4480 set thread context of 3520 4480 spoolsv.exe 135 PID 1476 set thread context of 3688 1476 spoolsv.exe 137 PID 3916 set thread context of 2460 3916 spoolsv.exe 138 PID 856 set thread context of 2616 856 spoolsv.exe 140 PID 3668 set thread context of 1788 3668 spoolsv.exe 142 PID 1536 set thread context of 1952 1536 spoolsv.exe 144 PID 3348 set thread context of 752 3348 spoolsv.exe 145 PID 4332 set thread context of 4648 4332 spoolsv.exe 147 PID 2620 set thread context of 1972 2620 spoolsv.exe 148 PID 1984 set thread context of 4464 1984 spoolsv.exe 150 PID 3612 set thread context of 2176 3612 spoolsv.exe 151 PID 4144 set thread context of 1132 4144 spoolsv.exe 153 PID 3244 set thread context of 1300 3244 spoolsv.exe 154 PID 1684 set thread context of 4732 1684 spoolsv.exe 155 PID 3680 set thread context of 4500 3680 spoolsv.exe 157 PID 3088 set thread context of 3284 3088 spoolsv.exe 159 PID 3724 set thread context of 1540 3724 spoolsv.exe 160 PID 3068 set thread context of 1760 3068 spoolsv.exe 162 PID 5036 set thread context of 3200 5036 spoolsv.exe 163 PID 3336 set thread context of 3972 3336 spoolsv.exe 165 PID 1072 set thread context of 808 1072 spoolsv.exe 166 PID 1280 set thread context of 2680 1280 spoolsv.exe 168 PID 2392 set thread context of 1868 2392 spoolsv.exe 172 PID 4928 set thread context of 320 4928 explorer.exe 176 PID 4976 set thread context of 1048 4976 spoolsv.exe 178 PID 2072 set thread context of 692 2072 explorer.exe 182 PID 4900 set thread context of 3396 4900 spoolsv.exe 183 PID 2196 set thread context of 2328 2196 spoolsv.exe 187 PID 4724 set thread context of 2380 4724 explorer.exe 189 PID 4956 set thread context of 1836 4956 spoolsv.exe 192 PID 212 set thread context of 3180 212 explorer.exe 195 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 1344 spoolsv.exe 1344 spoolsv.exe 4792 spoolsv.exe 4792 spoolsv.exe 2368 spoolsv.exe 2368 spoolsv.exe 1320 spoolsv.exe 1320 spoolsv.exe 3400 spoolsv.exe 3400 spoolsv.exe 3520 spoolsv.exe 3520 spoolsv.exe 3688 spoolsv.exe 3688 spoolsv.exe 2460 spoolsv.exe 2460 spoolsv.exe 2616 spoolsv.exe 2616 spoolsv.exe 1788 spoolsv.exe 1788 spoolsv.exe 1952 spoolsv.exe 1952 spoolsv.exe 752 spoolsv.exe 752 spoolsv.exe 4648 spoolsv.exe 4648 spoolsv.exe 1972 spoolsv.exe 1972 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 2176 spoolsv.exe 2176 spoolsv.exe 1132 spoolsv.exe 1132 spoolsv.exe 1300 spoolsv.exe 1300 spoolsv.exe 4732 spoolsv.exe 4732 spoolsv.exe 4500 spoolsv.exe 4500 spoolsv.exe 3284 spoolsv.exe 3284 spoolsv.exe 1540 spoolsv.exe 1540 spoolsv.exe 1760 spoolsv.exe 1760 spoolsv.exe 3200 spoolsv.exe 3200 spoolsv.exe 3972 spoolsv.exe 3972 spoolsv.exe 808 spoolsv.exe 808 spoolsv.exe 2680 spoolsv.exe 2680 spoolsv.exe 1868 spoolsv.exe 1868 spoolsv.exe 320 explorer.exe 320 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 868 wrote to memory of 2572 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 83 PID 868 wrote to memory of 2572 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 83 PID 868 wrote to memory of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 868 wrote to memory of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 868 wrote to memory of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 868 wrote to memory of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 868 wrote to memory of 1616 868 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 95 PID 1616 wrote to memory of 3440 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 96 PID 1616 wrote to memory of 3440 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 96 PID 1616 wrote to memory of 3440 1616 d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe 96 PID 3440 wrote to memory of 4236 3440 explorer.exe 98 PID 3440 wrote to memory of 4236 3440 explorer.exe 98 PID 3440 wrote to memory of 4236 3440 explorer.exe 98 PID 3440 wrote to memory of 4236 3440 explorer.exe 98 PID 3440 wrote to memory of 4236 3440 explorer.exe 98 PID 4236 wrote to memory of 2508 4236 explorer.exe 99 PID 4236 wrote to memory of 2508 4236 explorer.exe 99 PID 4236 wrote to memory of 2508 4236 explorer.exe 99 PID 4236 wrote to memory of 3356 4236 explorer.exe 100 PID 4236 wrote to memory of 3356 4236 explorer.exe 100 PID 4236 wrote to memory of 3356 4236 explorer.exe 100 PID 4236 wrote to memory of 852 4236 explorer.exe 101 PID 4236 wrote to memory of 852 4236 explorer.exe 101 PID 4236 wrote to memory of 852 4236 explorer.exe 101 PID 4236 wrote to memory of 1596 4236 explorer.exe 102 PID 4236 wrote to memory of 1596 4236 explorer.exe 102 PID 4236 wrote to memory of 1596 4236 explorer.exe 102 PID 4236 wrote to memory of 3228 4236 explorer.exe 103 PID 4236 wrote to memory of 3228 4236 explorer.exe 103 PID 4236 wrote to memory of 3228 4236 explorer.exe 103 PID 4236 wrote to memory of 4480 4236 explorer.exe 104 PID 4236 wrote to memory of 4480 4236 explorer.exe 104 PID 4236 wrote to memory of 4480 4236 explorer.exe 104 PID 4236 wrote to memory of 1476 4236 explorer.exe 105 PID 4236 wrote to memory of 1476 4236 explorer.exe 105 PID 4236 wrote to memory of 1476 4236 explorer.exe 105 PID 4236 wrote to memory of 3916 4236 explorer.exe 106 PID 4236 wrote to memory of 3916 4236 explorer.exe 106 PID 4236 wrote to memory of 3916 4236 explorer.exe 106 PID 4236 wrote to memory of 856 4236 explorer.exe 107 PID 4236 wrote to memory of 856 4236 explorer.exe 107 PID 4236 wrote to memory of 856 4236 explorer.exe 107 PID 4236 wrote to memory of 3668 4236 explorer.exe 108 PID 4236 wrote to memory of 3668 4236 explorer.exe 108 PID 4236 wrote to memory of 3668 4236 explorer.exe 108 PID 4236 wrote to memory of 1536 4236 explorer.exe 109 PID 4236 wrote to memory of 1536 4236 explorer.exe 109 PID 4236 wrote to memory of 1536 4236 explorer.exe 109 PID 4236 wrote to memory of 3348 4236 explorer.exe 110 PID 4236 wrote to memory of 3348 4236 explorer.exe 110 PID 4236 wrote to memory of 3348 4236 explorer.exe 110 PID 4236 wrote to memory of 4332 4236 explorer.exe 111 PID 4236 wrote to memory of 4332 4236 explorer.exe 111 PID 4236 wrote to memory of 4332 4236 explorer.exe 111 PID 4236 wrote to memory of 2620 4236 explorer.exe 112 PID 4236 wrote to memory of 2620 4236 explorer.exe 112 PID 4236 wrote to memory of 2620 4236 explorer.exe 112 PID 4236 wrote to memory of 1984 4236 explorer.exe 113 PID 4236 wrote to memory of 1984 4236 explorer.exe 113 PID 4236 wrote to memory of 1984 4236 explorer.exe 113 PID 4236 wrote to memory of 3612 4236 explorer.exe 114 PID 4236 wrote to memory of 3612 4236 explorer.exe 114 PID 4236 wrote to memory of 3612 4236 explorer.exe 114 PID 4236 wrote to memory of 4144 4236 explorer.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0d4c25a8ce74749772b112963da7c16_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4928 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:320
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3400 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:692
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2460
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4724 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2380
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:752 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:3180
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2176 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2144 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4692
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4500 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3756 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3496
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3200 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4304 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1232
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1072 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:808
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2680 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4024 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1464
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1868 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4416 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4184
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3656 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3644
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3396
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2148 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3564
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2328
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1836 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1960
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4020
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2864
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3232
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5072
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3512 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3184
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3364
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1660
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3620
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2640
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2644
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3308
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:916
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4556
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD58c36651d446edb09b1efa7bb11586a61
SHA1854d9e98ec9fef151a16096cd6dc98f433b5abbc
SHA2569036426bbee6c2cbec460ccc89e3b8ecf0c28d7255fe3bf4670d56243c8392c5
SHA5126095a98e2b097acf2750d20108e9790261e382cda80a7971b5add1be1972c6718502d0010d391fea2107a5cb1cacf6603fc796953bcd5635a2fa2d94b599ab82
-
Filesize
2.2MB
MD59ed1ef841d59d8242a0844ed7c251421
SHA13f523348cd35beb3b6440c7a50bfbaa9aa5d7ef0
SHA256f7d570ec675e02a40841b86ea99b8454dce3d203ff626fd79a52f53dd02d0001
SHA51221cbecfc559cde4db74d31ec1ab735609a41f7fb74d80b5768a5e6b954325e4b441b70b36bcd0444f8c5a4573bf98e0922b3676abb8000327bdf1163efb76f78