Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 20:16
Behavioral task
behavioral1
Sample
d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
d2c141b7ff45d200f6dfcbd93c4fef12
-
SHA1
9438bc8f9085593581a35ada141e7b717f76e810
-
SHA256
f5fea1924957de973880875e9a7666d38978bafdcae71f8ff7d276b21a75f468
-
SHA512
51c1bf6703d31d2344719ec1cc0867ee03dd8f2ef5062fbce6bb221c27421ac38d3672345c5ec90c8b40aee3c676a422ce694c991402107133909440db1568d6
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwI
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3952 explorer.exe 2440 explorer.exe 1456 spoolsv.exe 5040 spoolsv.exe 3564 spoolsv.exe 4124 spoolsv.exe 3724 spoolsv.exe 1360 spoolsv.exe 3076 spoolsv.exe 728 spoolsv.exe 4608 spoolsv.exe 1232 spoolsv.exe 1596 spoolsv.exe 4808 spoolsv.exe 1400 spoolsv.exe 316 spoolsv.exe 3936 spoolsv.exe 4492 spoolsv.exe 4352 spoolsv.exe 2400 spoolsv.exe 2624 spoolsv.exe 376 spoolsv.exe 2644 spoolsv.exe 4760 spoolsv.exe 224 spoolsv.exe 2856 spoolsv.exe 2192 spoolsv.exe 4316 spoolsv.exe 2244 spoolsv.exe 4264 spoolsv.exe 1972 spoolsv.exe 3444 spoolsv.exe 2664 spoolsv.exe 3296 spoolsv.exe 2256 spoolsv.exe 1720 explorer.exe 4276 spoolsv.exe 1200 spoolsv.exe 1568 spoolsv.exe 5104 spoolsv.exe 3764 spoolsv.exe 4072 spoolsv.exe 1116 spoolsv.exe 4012 spoolsv.exe 3548 spoolsv.exe 2760 explorer.exe 1884 spoolsv.exe 4912 spoolsv.exe 3504 spoolsv.exe 2828 spoolsv.exe 3376 explorer.exe 2640 spoolsv.exe 3968 spoolsv.exe 772 spoolsv.exe 4616 spoolsv.exe 1776 spoolsv.exe 228 spoolsv.exe 8 spoolsv.exe 3456 explorer.exe 4060 spoolsv.exe 4044 spoolsv.exe 692 spoolsv.exe 1676 spoolsv.exe 4000 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
description pid Process procid_target PID 5020 set thread context of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 3952 set thread context of 2440 3952 explorer.exe 98 PID 1456 set thread context of 2256 1456 spoolsv.exe 131 PID 5040 set thread context of 4276 5040 spoolsv.exe 133 PID 3564 set thread context of 1568 3564 spoolsv.exe 136 PID 4124 set thread context of 5104 4124 spoolsv.exe 137 PID 3724 set thread context of 3764 3724 spoolsv.exe 138 PID 1360 set thread context of 4072 1360 spoolsv.exe 139 PID 3076 set thread context of 1116 3076 spoolsv.exe 140 PID 728 set thread context of 3548 728 spoolsv.exe 142 PID 4608 set thread context of 1884 4608 spoolsv.exe 144 PID 1232 set thread context of 4912 1232 spoolsv.exe 145 PID 1596 set thread context of 2828 1596 spoolsv.exe 147 PID 4808 set thread context of 2640 4808 spoolsv.exe 149 PID 1400 set thread context of 3968 1400 spoolsv.exe 150 PID 316 set thread context of 772 316 spoolsv.exe 151 PID 3936 set thread context of 4616 3936 spoolsv.exe 152 PID 4492 set thread context of 228 4492 spoolsv.exe 154 PID 4352 set thread context of 8 4352 spoolsv.exe 155 PID 2400 set thread context of 4060 2400 spoolsv.exe 157 PID 2624 set thread context of 4044 2624 spoolsv.exe 158 PID 376 set thread context of 1676 376 spoolsv.exe 160 PID 2644 set thread context of 4000 2644 spoolsv.exe 161 PID 4760 set thread context of 212 4760 spoolsv.exe 163 PID 224 set thread context of 2092 224 spoolsv.exe 164 PID 2856 set thread context of 5100 2856 spoolsv.exe 165 PID 2192 set thread context of 4936 2192 spoolsv.exe 167 PID 4316 set thread context of 1616 4316 spoolsv.exe 168 PID 2244 set thread context of 336 2244 spoolsv.exe 169 PID 4264 set thread context of 2848 4264 spoolsv.exe 171 PID 1972 set thread context of 4604 1972 spoolsv.exe 172 PID 3444 set thread context of 468 3444 spoolsv.exe 174 PID 2664 set thread context of 2156 2664 spoolsv.exe 175 PID 3296 set thread context of 460 3296 spoolsv.exe 180 PID 1200 set thread context of 1036 1200 spoolsv.exe 184 PID 1720 set thread context of 1592 1720 explorer.exe 186 PID 4012 set thread context of 984 4012 spoolsv.exe 190 PID 2760 set thread context of 1536 2760 explorer.exe 192 PID 3504 set thread context of 4884 3504 spoolsv.exe 196 PID 3376 set thread context of 1432 3376 explorer.exe 198 PID 1776 set thread context of 3692 1776 spoolsv.exe 201 PID 3456 set thread context of 4332 3456 explorer.exe 204 PID 692 set thread context of 2204 692 spoolsv.exe 207 PID 3144 set thread context of 3092 3144 explorer.exe 211 PID 352 set thread context of 1452 352 spoolsv.exe 214 PID 1012 set thread context of 2472 1012 explorer.exe 216 PID 5116 set thread context of 5036 5116 spoolsv.exe 217 PID 2628 set thread context of 2704 2628 explorer.exe 218 PID 2284 set thread context of 4792 2284 spoolsv.exe 220 PID 1100 set thread context of 844 1100 spoolsv.exe 221 PID 4248 set thread context of 4592 4248 spoolsv.exe 222 PID 2212 set thread context of 4756 2212 explorer.exe 223 PID 1236 set thread context of 1268 1236 spoolsv.exe 224 PID 3448 set thread context of 3160 3448 spoolsv.exe 226 PID 1004 set thread context of 3912 1004 explorer.exe 228 PID 1732 set thread context of 4272 1732 spoolsv.exe 229 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2440 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2440 explorer.exe 2256 spoolsv.exe 2256 spoolsv.exe 4276 spoolsv.exe 4276 spoolsv.exe 1568 spoolsv.exe 1568 spoolsv.exe 5104 spoolsv.exe 5104 spoolsv.exe 3764 spoolsv.exe 3764 spoolsv.exe 4072 spoolsv.exe 4072 spoolsv.exe 1116 spoolsv.exe 1116 spoolsv.exe 3548 spoolsv.exe 3548 spoolsv.exe 1884 spoolsv.exe 1884 spoolsv.exe 4912 spoolsv.exe 4912 spoolsv.exe 2828 spoolsv.exe 2828 spoolsv.exe 2640 spoolsv.exe 2640 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 772 spoolsv.exe 772 spoolsv.exe 4616 spoolsv.exe 4616 spoolsv.exe 228 spoolsv.exe 228 spoolsv.exe 8 spoolsv.exe 8 spoolsv.exe 4060 spoolsv.exe 4060 spoolsv.exe 4044 spoolsv.exe 4044 spoolsv.exe 1676 spoolsv.exe 1676 spoolsv.exe 4000 spoolsv.exe 4000 spoolsv.exe 212 spoolsv.exe 212 spoolsv.exe 2092 spoolsv.exe 2092 spoolsv.exe 5100 spoolsv.exe 5100 spoolsv.exe 4936 spoolsv.exe 4936 spoolsv.exe 1616 spoolsv.exe 1616 spoolsv.exe 336 spoolsv.exe 336 spoolsv.exe 2848 spoolsv.exe 2848 spoolsv.exe 4604 spoolsv.exe 4604 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2696 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 85 PID 5020 wrote to memory of 2696 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 85 PID 5020 wrote to memory of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 5020 wrote to memory of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 5020 wrote to memory of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 5020 wrote to memory of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 5020 wrote to memory of 3660 5020 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 95 PID 3660 wrote to memory of 3952 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 96 PID 3660 wrote to memory of 3952 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 96 PID 3660 wrote to memory of 3952 3660 d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe 96 PID 3952 wrote to memory of 2440 3952 explorer.exe 98 PID 3952 wrote to memory of 2440 3952 explorer.exe 98 PID 3952 wrote to memory of 2440 3952 explorer.exe 98 PID 3952 wrote to memory of 2440 3952 explorer.exe 98 PID 3952 wrote to memory of 2440 3952 explorer.exe 98 PID 2440 wrote to memory of 1456 2440 explorer.exe 99 PID 2440 wrote to memory of 1456 2440 explorer.exe 99 PID 2440 wrote to memory of 1456 2440 explorer.exe 99 PID 2440 wrote to memory of 5040 2440 explorer.exe 100 PID 2440 wrote to memory of 5040 2440 explorer.exe 100 PID 2440 wrote to memory of 5040 2440 explorer.exe 100 PID 2440 wrote to memory of 3564 2440 explorer.exe 101 PID 2440 wrote to memory of 3564 2440 explorer.exe 101 PID 2440 wrote to memory of 3564 2440 explorer.exe 101 PID 2440 wrote to memory of 4124 2440 explorer.exe 102 PID 2440 wrote to memory of 4124 2440 explorer.exe 102 PID 2440 wrote to memory of 4124 2440 explorer.exe 102 PID 2440 wrote to memory of 3724 2440 explorer.exe 103 PID 2440 wrote to memory of 3724 2440 explorer.exe 103 PID 2440 wrote to memory of 3724 2440 explorer.exe 103 PID 2440 wrote to memory of 1360 2440 explorer.exe 104 PID 2440 wrote to memory of 1360 2440 explorer.exe 104 PID 2440 wrote to memory of 1360 2440 explorer.exe 104 PID 2440 wrote to memory of 3076 2440 explorer.exe 105 PID 2440 wrote to memory of 3076 2440 explorer.exe 105 PID 2440 wrote to memory of 3076 2440 explorer.exe 105 PID 2440 wrote to memory of 728 2440 explorer.exe 106 PID 2440 wrote to memory of 728 2440 explorer.exe 106 PID 2440 wrote to memory of 728 2440 explorer.exe 106 PID 2440 wrote to memory of 4608 2440 explorer.exe 107 PID 2440 wrote to memory of 4608 2440 explorer.exe 107 PID 2440 wrote to memory of 4608 2440 explorer.exe 107 PID 2440 wrote to memory of 1232 2440 explorer.exe 108 PID 2440 wrote to memory of 1232 2440 explorer.exe 108 PID 2440 wrote to memory of 1232 2440 explorer.exe 108 PID 2440 wrote to memory of 1596 2440 explorer.exe 109 PID 2440 wrote to memory of 1596 2440 explorer.exe 109 PID 2440 wrote to memory of 1596 2440 explorer.exe 109 PID 2440 wrote to memory of 4808 2440 explorer.exe 110 PID 2440 wrote to memory of 4808 2440 explorer.exe 110 PID 2440 wrote to memory of 4808 2440 explorer.exe 110 PID 2440 wrote to memory of 1400 2440 explorer.exe 111 PID 2440 wrote to memory of 1400 2440 explorer.exe 111 PID 2440 wrote to memory of 1400 2440 explorer.exe 111 PID 2440 wrote to memory of 316 2440 explorer.exe 112 PID 2440 wrote to memory of 316 2440 explorer.exe 112 PID 2440 wrote to memory of 316 2440 explorer.exe 112 PID 2440 wrote to memory of 3936 2440 explorer.exe 113 PID 2440 wrote to memory of 3936 2440 explorer.exe 113 PID 2440 wrote to memory of 3936 2440 explorer.exe 113 PID 2440 wrote to memory of 4492 2440 explorer.exe 114 PID 2440 wrote to memory of 4492 2440 explorer.exe 114 PID 2440 wrote to memory of 4492 2440 explorer.exe 114 PID 2440 wrote to memory of 4352 2440 explorer.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2c141b7ff45d200f6dfcbd93c4fef12_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1456 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1720 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1592
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4276
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3548 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1536
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2828 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:772
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3456 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4332
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1676
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4000 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3144 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3092
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:212
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4936
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:336 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1012 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2472
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:468
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:460
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4756
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1036
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:1004 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3912
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:984
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4820
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4884 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2928
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3304
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2204
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4268
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1452 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:3696
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5036
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4792
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:844
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1268
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3160 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4272
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2480
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3452
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:720
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4540
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3256
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3928
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:896
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1256
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4028
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4980
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:840
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4320
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4424
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5020
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:928
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD53f6c1cadf7eaa2ba54116cce2a96b814
SHA119037c43a72eaa07242f5c9f41e0f395c6bb3f89
SHA25695a8ec1abebaefb6d7c0472702e7a7ddaf4a1b27c1bd773729c03458593f0fc5
SHA512447ecf598915afe70ce59f33e941fe8958a0f7589058634eef91d8949eb4aefeefa6f03b7a69cca60c7fdb94cc43d7fbedbad600025240d662554283b8191b42
-
Filesize
2.2MB
MD583b782842baf8d202efd1d0e443863b2
SHA1c23d6e922f2c9b99b9e2e76c02205a3245dc15b3
SHA2569a7071aa79f7ed6185e5cb5e6dd61ef8e45bfde896d65d56c5d51a62ea19fab0
SHA512bb3b75bb27003f8b4193d39634b2b20404428f9d418bb8956bc97a3e303a299940a664db7e017ca569c2f59e6afea0d2c903e94e373768ee0aef9c78c39dc4f7