Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/09/2024, 07:36
Behavioral task
behavioral1
Sample
d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
d7cd72e919e9f04416ea4dc6878819fc
-
SHA1
eef2e706dea8c9b63704bf2cd2659ace89d30bd6
-
SHA256
3785d2c4b041b63767b6a59128a2b375befeb71aab0cd93fe4f2959a47b7b035
-
SHA512
35af6a3bd30cc97c070f8db06627c066d3b0b83a4f07aa7a54a446419e32fe55fb0a9345881f634a33a03b6effe02a7268ddbbed62585be8b6049257f1e6ae1d
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWww5
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2540 explorer.exe 1680 explorer.exe 1120 spoolsv.exe 2036 spoolsv.exe 2912 spoolsv.exe 952 spoolsv.exe 436 spoolsv.exe 1068 spoolsv.exe 2552 spoolsv.exe 1380 spoolsv.exe 2524 spoolsv.exe 1364 spoolsv.exe 804 spoolsv.exe 2452 spoolsv.exe 1572 spoolsv.exe 2564 spoolsv.exe 2880 spoolsv.exe 1656 spoolsv.exe 2080 spoolsv.exe 1548 spoolsv.exe 700 spoolsv.exe 1956 spoolsv.exe 2796 spoolsv.exe 620 spoolsv.exe 2844 spoolsv.exe 1304 spoolsv.exe 1856 spoolsv.exe 2328 spoolsv.exe 2772 spoolsv.exe 2308 spoolsv.exe 684 spoolsv.exe 1020 spoolsv.exe 2424 spoolsv.exe 2648 spoolsv.exe 2548 spoolsv.exe 1920 spoolsv.exe 2056 spoolsv.exe 916 spoolsv.exe 3036 spoolsv.exe 1928 spoolsv.exe 1204 spoolsv.exe 2960 spoolsv.exe 2740 spoolsv.exe 2016 spoolsv.exe 3064 spoolsv.exe 2404 spoolsv.exe 2728 spoolsv.exe 1560 spoolsv.exe 2096 spoolsv.exe 2168 spoolsv.exe 1992 spoolsv.exe 1084 spoolsv.exe 2752 spoolsv.exe 1792 spoolsv.exe 2868 spoolsv.exe 3020 spoolsv.exe 2172 explorer.exe 2136 spoolsv.exe 2492 spoolsv.exe 2824 spoolsv.exe 1700 spoolsv.exe 2192 spoolsv.exe 3040 spoolsv.exe 3004 explorer.exe -
Loads dropped DLL 64 IoCs
pid Process 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 29 IoCs
description pid Process procid_target PID 2300 set thread context of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2540 set thread context of 1680 2540 explorer.exe 32 PID 1120 set thread context of 3020 1120 spoolsv.exe 86 PID 2036 set thread context of 2136 2036 spoolsv.exe 88 PID 2912 set thread context of 2492 2912 spoolsv.exe 89 PID 952 set thread context of 2824 952 spoolsv.exe 90 PID 436 set thread context of 2192 436 spoolsv.exe 92 PID 1068 set thread context of 3040 1068 spoolsv.exe 93 PID 2552 set thread context of 3220 2552 spoolsv.exe 96 PID 1380 set thread context of 3236 1380 spoolsv.exe 97 PID 2524 set thread context of 3436 2524 spoolsv.exe 98 PID 804 set thread context of 3640 804 spoolsv.exe 100 PID 1364 set thread context of 3696 1364 spoolsv.exe 101 PID 2452 set thread context of 3860 2452 spoolsv.exe 103 PID 1572 set thread context of 3968 1572 spoolsv.exe 104 PID 2564 set thread context of 2784 2564 spoolsv.exe 105 PID 2880 set thread context of 1988 2880 spoolsv.exe 106 PID 1656 set thread context of 3296 1656 spoolsv.exe 108 PID 2080 set thread context of 944 2080 spoolsv.exe 109 PID 1792 set thread context of 3016 1792 spoolsv.exe 110 PID 1548 set thread context of 3612 1548 spoolsv.exe 111 PID 700 set thread context of 1608 700 spoolsv.exe 112 PID 2796 set thread context of 3720 2796 spoolsv.exe 113 PID 1956 set thread context of 3888 1956 spoolsv.exe 114 PID 620 set thread context of 3816 620 spoolsv.exe 115 PID 1856 set thread context of 3988 1856 spoolsv.exe 117 PID 2844 set thread context of 3996 2844 spoolsv.exe 118 PID 1304 set thread context of 4008 1304 spoolsv.exe 119 PID 2328 set thread context of 2848 2328 spoolsv.exe 120 -
Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1680 explorer.exe -
Suspicious use of SetWindowsHookEx 58 IoCs
pid Process 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 3020 spoolsv.exe 3020 spoolsv.exe 2136 spoolsv.exe 2136 spoolsv.exe 2492 spoolsv.exe 2492 spoolsv.exe 2824 spoolsv.exe 2824 spoolsv.exe 2192 spoolsv.exe 2192 spoolsv.exe 3040 spoolsv.exe 3040 spoolsv.exe 3220 spoolsv.exe 3220 spoolsv.exe 3236 spoolsv.exe 3236 spoolsv.exe 3436 spoolsv.exe 3436 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 3696 spoolsv.exe 3696 spoolsv.exe 3860 spoolsv.exe 3860 spoolsv.exe 3968 spoolsv.exe 3968 spoolsv.exe 2784 spoolsv.exe 2784 spoolsv.exe 1988 spoolsv.exe 1988 spoolsv.exe 3296 spoolsv.exe 3296 spoolsv.exe 944 spoolsv.exe 944 spoolsv.exe 3016 spoolsv.exe 3016 spoolsv.exe 3612 spoolsv.exe 3612 spoolsv.exe 1608 spoolsv.exe 1608 spoolsv.exe 3720 spoolsv.exe 3720 spoolsv.exe 3888 spoolsv.exe 3888 spoolsv.exe 3816 spoolsv.exe 3816 spoolsv.exe 3988 spoolsv.exe 3988 spoolsv.exe 3996 spoolsv.exe 3996 spoolsv.exe 4008 spoolsv.exe 4008 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2280 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 29 PID 2300 wrote to memory of 2280 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 29 PID 2300 wrote to memory of 2280 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 29 PID 2300 wrote to memory of 2280 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 29 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2300 wrote to memory of 2640 2300 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2540 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2540 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2540 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2540 2640 d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe 31 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 2540 wrote to memory of 1680 2540 explorer.exe 32 PID 1680 wrote to memory of 1120 1680 explorer.exe 33 PID 1680 wrote to memory of 1120 1680 explorer.exe 33 PID 1680 wrote to memory of 1120 1680 explorer.exe 33 PID 1680 wrote to memory of 1120 1680 explorer.exe 33 PID 1680 wrote to memory of 2036 1680 explorer.exe 34 PID 1680 wrote to memory of 2036 1680 explorer.exe 34 PID 1680 wrote to memory of 2036 1680 explorer.exe 34 PID 1680 wrote to memory of 2036 1680 explorer.exe 34 PID 1680 wrote to memory of 2912 1680 explorer.exe 35 PID 1680 wrote to memory of 2912 1680 explorer.exe 35 PID 1680 wrote to memory of 2912 1680 explorer.exe 35 PID 1680 wrote to memory of 2912 1680 explorer.exe 35 PID 1680 wrote to memory of 952 1680 explorer.exe 36 PID 1680 wrote to memory of 952 1680 explorer.exe 36 PID 1680 wrote to memory of 952 1680 explorer.exe 36 PID 1680 wrote to memory of 952 1680 explorer.exe 36 PID 1680 wrote to memory of 436 1680 explorer.exe 37 PID 1680 wrote to memory of 436 1680 explorer.exe 37 PID 1680 wrote to memory of 436 1680 explorer.exe 37 PID 1680 wrote to memory of 436 1680 explorer.exe 37 PID 1680 wrote to memory of 1068 1680 explorer.exe 38 PID 1680 wrote to memory of 1068 1680 explorer.exe 38 PID 1680 wrote to memory of 1068 1680 explorer.exe 38 PID 1680 wrote to memory of 1068 1680 explorer.exe 38 PID 1680 wrote to memory of 2552 1680 explorer.exe 39 PID 1680 wrote to memory of 2552 1680 explorer.exe 39 PID 1680 wrote to memory of 2552 1680 explorer.exe 39 PID 1680 wrote to memory of 2552 1680 explorer.exe 39 PID 1680 wrote to memory of 1380 1680 explorer.exe 40 PID 1680 wrote to memory of 1380 1680 explorer.exe 40 PID 1680 wrote to memory of 1380 1680 explorer.exe 40 PID 1680 wrote to memory of 1380 1680 explorer.exe 40 PID 1680 wrote to memory of 2524 1680 explorer.exe 41 PID 1680 wrote to memory of 2524 1680 explorer.exe 41 PID 1680 wrote to memory of 2524 1680 explorer.exe 41 PID 1680 wrote to memory of 2524 1680 explorer.exe 41 PID 1680 wrote to memory of 1364 1680 explorer.exe 42 PID 1680 wrote to memory of 1364 1680 explorer.exe 42 PID 1680 wrote to memory of 1364 1680 explorer.exe 42 PID 1680 wrote to memory of 1364 1680 explorer.exe 42 PID 1680 wrote to memory of 804 1680 explorer.exe 43 PID 1680 wrote to memory of 804 1680 explorer.exe 43 PID 1680 wrote to memory of 804 1680 explorer.exe 43 PID 1680 wrote to memory of 804 1680 explorer.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7cd72e919e9f04416ea4dc6878819fc_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3020 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
PID:2172
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2136
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:952 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2824
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3040 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3696
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3640 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:3744
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1656 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3296
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3720 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:2180
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2848
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2772 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3196
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1596
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3648
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2512
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3036 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3656
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2356
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4088
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:336
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3428
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:2868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1092
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3516
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1972
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52791a72add62383a37a9e40862c75dda
SHA1775516c5a60d8b4f4e3676bbddc4b5f2241c57b9
SHA25617e2ac6c1b641f19c7530bebc03c2db0b257b951f551594af3ca80e06dc41e93
SHA512e078d1b29952112c9f6ba97f43615b83ae3e0eaa3e97f204a4fa056c309c87a919d1cb66f1266ff776e3b571cd731b1b44b91d1d9ccb4dcb5b40d2147fc914fb
-
Filesize
2.2MB
MD5f5c1b82785d906515fc8ffe7253dcaf0
SHA1b3f8d2d3072ddb56930b98af0d8b411fbf55f3b1
SHA2560fccfd0866ea04365554d39fa9165955f187a477fad149bc6c6eac942f300a8d
SHA512793caa5f63b0714a4b69b84fb7a386e4aea7d36178d69de44bba868e3df8c0f2181363355e74fe1aa35feb79b3b4fc97bf2f10fe3a81d02638ffd2fbf2ed7125