Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 02:11
Behavioral task
behavioral1
Sample
e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
e1808dcf7c396b14857d25dbdb109c0b
-
SHA1
74dbbed8b612797c813fc4c8918c0d8aac7187ad
-
SHA256
980e9470bd5272b7798e03f133da81e269e83232c30be53b7f4a315c762dad18
-
SHA512
5f265646a9264914b41af40323ff1f0dc711ac1a2d3bfd01cf28c6bbba23e71ead7f4a92c3bb7e0edfc276a41e52ab296de9b6671872f1fa069a9ad9d85918f7
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWwwf
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1064 explorer.exe 2284 explorer.exe 4724 spoolsv.exe 1228 spoolsv.exe 1944 spoolsv.exe 4444 spoolsv.exe 1960 spoolsv.exe 2216 spoolsv.exe 1176 spoolsv.exe 1696 spoolsv.exe 1348 spoolsv.exe 348 spoolsv.exe 4100 spoolsv.exe 464 spoolsv.exe 3152 spoolsv.exe 2436 spoolsv.exe 2888 spoolsv.exe 3364 spoolsv.exe 3224 spoolsv.exe 3552 spoolsv.exe 1556 spoolsv.exe 4692 spoolsv.exe 4428 spoolsv.exe 3112 spoolsv.exe 3708 spoolsv.exe 1924 spoolsv.exe 2092 spoolsv.exe 2744 spoolsv.exe 1620 spoolsv.exe 1480 spoolsv.exe 1920 spoolsv.exe 4732 spoolsv.exe 3724 spoolsv.exe 668 spoolsv.exe 1244 spoolsv.exe 4124 spoolsv.exe 3916 spoolsv.exe 4332 explorer.exe 2508 spoolsv.exe 3752 spoolsv.exe 4792 spoolsv.exe 4228 spoolsv.exe 4260 spoolsv.exe 2584 spoolsv.exe 4488 spoolsv.exe 1444 spoolsv.exe 4468 spoolsv.exe 3172 explorer.exe 3624 spoolsv.exe 1508 spoolsv.exe 3324 spoolsv.exe 3200 spoolsv.exe 4344 spoolsv.exe 740 spoolsv.exe 4432 explorer.exe 1440 spoolsv.exe 3136 spoolsv.exe 3068 spoolsv.exe 4752 spoolsv.exe 4876 spoolsv.exe 3376 spoolsv.exe 2960 spoolsv.exe 1104 spoolsv.exe 3240 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 56 IoCs
description pid Process procid_target PID 1944 set thread context of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1064 set thread context of 2284 1064 explorer.exe 99 PID 4724 set thread context of 3916 4724 spoolsv.exe 134 PID 1228 set thread context of 2508 1228 spoolsv.exe 136 PID 1944 set thread context of 3752 1944 spoolsv.exe 137 PID 4444 set thread context of 4228 4444 spoolsv.exe 139 PID 1960 set thread context of 4260 1960 spoolsv.exe 140 PID 2216 set thread context of 2584 2216 spoolsv.exe 141 PID 1176 set thread context of 4488 1176 spoolsv.exe 142 PID 1696 set thread context of 1444 1696 spoolsv.exe 143 PID 1348 set thread context of 4468 1348 spoolsv.exe 144 PID 348 set thread context of 3624 348 spoolsv.exe 146 PID 4100 set thread context of 1508 4100 spoolsv.exe 147 PID 464 set thread context of 3200 464 spoolsv.exe 149 PID 3152 set thread context of 4344 3152 spoolsv.exe 150 PID 2436 set thread context of 740 2436 spoolsv.exe 151 PID 2888 set thread context of 1440 2888 spoolsv.exe 153 PID 3364 set thread context of 3136 3364 spoolsv.exe 154 PID 3224 set thread context of 3068 3224 spoolsv.exe 155 PID 3552 set thread context of 4752 3552 spoolsv.exe 156 PID 1556 set thread context of 3376 1556 spoolsv.exe 158 PID 4692 set thread context of 2960 4692 spoolsv.exe 159 PID 4428 set thread context of 1104 4428 spoolsv.exe 160 PID 3112 set thread context of 3240 3112 spoolsv.exe 161 PID 3708 set thread context of 3628 3708 spoolsv.exe 162 PID 1924 set thread context of 636 1924 spoolsv.exe 164 PID 2092 set thread context of 4688 2092 spoolsv.exe 166 PID 2744 set thread context of 4316 2744 spoolsv.exe 167 PID 1620 set thread context of 4704 1620 spoolsv.exe 168 PID 1480 set thread context of 4320 1480 spoolsv.exe 170 PID 1920 set thread context of 4056 1920 spoolsv.exe 172 PID 4732 set thread context of 1540 4732 spoolsv.exe 173 PID 3724 set thread context of 3028 3724 spoolsv.exe 174 PID 668 set thread context of 3872 668 spoolsv.exe 175 PID 1244 set thread context of 4256 1244 spoolsv.exe 178 PID 4124 set thread context of 5112 4124 spoolsv.exe 181 PID 4332 set thread context of 1604 4332 explorer.exe 188 PID 4792 set thread context of 2968 4792 spoolsv.exe 191 PID 3172 set thread context of 1636 3172 explorer.exe 194 PID 3324 set thread context of 4288 3324 spoolsv.exe 199 PID 4432 set thread context of 3740 4432 explorer.exe 205 PID 4876 set thread context of 912 4876 spoolsv.exe 207 PID 4212 set thread context of 2824 4212 explorer.exe 211 PID 3712 set thread context of 5576 3712 spoolsv.exe 214 PID 3236 set thread context of 5432 3236 explorer.exe 218 PID 3752 set thread context of 5936 3752 spoolsv.exe 220 PID 3472 set thread context of 6044 3472 explorer.exe 222 PID 1544 set thread context of 6092 1544 spoolsv.exe 223 PID 2848 set thread context of 5620 2848 spoolsv.exe 224 PID 5068 set thread context of 5424 5068 spoolsv.exe 226 PID 4252 set thread context of 5828 4252 spoolsv.exe 227 PID 820 set thread context of 4136 820 explorer.exe 229 PID 4856 set thread context of 5988 4856 spoolsv.exe 230 PID 3444 set thread context of 6068 3444 spoolsv.exe 231 PID 4924 set thread context of 2528 4924 spoolsv.exe 233 PID 1548 set thread context of 5636 1548 spoolsv.exe 234 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 2284 explorer.exe 3916 spoolsv.exe 3916 spoolsv.exe 2508 spoolsv.exe 2508 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe 4228 spoolsv.exe 4228 spoolsv.exe 4260 spoolsv.exe 4260 spoolsv.exe 2584 spoolsv.exe 2584 spoolsv.exe 4488 spoolsv.exe 4488 spoolsv.exe 1444 spoolsv.exe 1444 spoolsv.exe 4468 spoolsv.exe 4468 spoolsv.exe 3624 spoolsv.exe 3624 spoolsv.exe 1508 spoolsv.exe 1508 spoolsv.exe 3200 spoolsv.exe 3200 spoolsv.exe 4344 spoolsv.exe 4344 spoolsv.exe 740 spoolsv.exe 740 spoolsv.exe 1440 spoolsv.exe 1440 spoolsv.exe 3136 spoolsv.exe 3136 spoolsv.exe 3068 spoolsv.exe 3068 spoolsv.exe 4752 spoolsv.exe 4752 spoolsv.exe 3376 spoolsv.exe 3376 spoolsv.exe 2960 spoolsv.exe 2960 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 3628 spoolsv.exe 3628 spoolsv.exe 636 spoolsv.exe 636 spoolsv.exe 4688 spoolsv.exe 4688 spoolsv.exe 4316 spoolsv.exe 4316 spoolsv.exe 4704 spoolsv.exe 4704 spoolsv.exe 4320 spoolsv.exe 4320 spoolsv.exe 4056 spoolsv.exe 4056 spoolsv.exe 1540 spoolsv.exe 1540 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 4680 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 85 PID 1944 wrote to memory of 4680 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 85 PID 1944 wrote to memory of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1944 wrote to memory of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1944 wrote to memory of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1944 wrote to memory of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1944 wrote to memory of 1056 1944 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 95 PID 1056 wrote to memory of 1064 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 96 PID 1056 wrote to memory of 1064 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 96 PID 1056 wrote to memory of 1064 1056 e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe 96 PID 1064 wrote to memory of 2284 1064 explorer.exe 99 PID 1064 wrote to memory of 2284 1064 explorer.exe 99 PID 1064 wrote to memory of 2284 1064 explorer.exe 99 PID 1064 wrote to memory of 2284 1064 explorer.exe 99 PID 1064 wrote to memory of 2284 1064 explorer.exe 99 PID 2284 wrote to memory of 4724 2284 explorer.exe 100 PID 2284 wrote to memory of 4724 2284 explorer.exe 100 PID 2284 wrote to memory of 4724 2284 explorer.exe 100 PID 2284 wrote to memory of 1228 2284 explorer.exe 101 PID 2284 wrote to memory of 1228 2284 explorer.exe 101 PID 2284 wrote to memory of 1228 2284 explorer.exe 101 PID 2284 wrote to memory of 1944 2284 explorer.exe 102 PID 2284 wrote to memory of 1944 2284 explorer.exe 102 PID 2284 wrote to memory of 1944 2284 explorer.exe 102 PID 2284 wrote to memory of 4444 2284 explorer.exe 103 PID 2284 wrote to memory of 4444 2284 explorer.exe 103 PID 2284 wrote to memory of 4444 2284 explorer.exe 103 PID 2284 wrote to memory of 1960 2284 explorer.exe 104 PID 2284 wrote to memory of 1960 2284 explorer.exe 104 PID 2284 wrote to memory of 1960 2284 explorer.exe 104 PID 2284 wrote to memory of 2216 2284 explorer.exe 105 PID 2284 wrote to memory of 2216 2284 explorer.exe 105 PID 2284 wrote to memory of 2216 2284 explorer.exe 105 PID 2284 wrote to memory of 1176 2284 explorer.exe 106 PID 2284 wrote to memory of 1176 2284 explorer.exe 106 PID 2284 wrote to memory of 1176 2284 explorer.exe 106 PID 2284 wrote to memory of 1696 2284 explorer.exe 107 PID 2284 wrote to memory of 1696 2284 explorer.exe 107 PID 2284 wrote to memory of 1696 2284 explorer.exe 107 PID 2284 wrote to memory of 1348 2284 explorer.exe 108 PID 2284 wrote to memory of 1348 2284 explorer.exe 108 PID 2284 wrote to memory of 1348 2284 explorer.exe 108 PID 2284 wrote to memory of 348 2284 explorer.exe 109 PID 2284 wrote to memory of 348 2284 explorer.exe 109 PID 2284 wrote to memory of 348 2284 explorer.exe 109 PID 2284 wrote to memory of 4100 2284 explorer.exe 110 PID 2284 wrote to memory of 4100 2284 explorer.exe 110 PID 2284 wrote to memory of 4100 2284 explorer.exe 110 PID 2284 wrote to memory of 464 2284 explorer.exe 111 PID 2284 wrote to memory of 464 2284 explorer.exe 111 PID 2284 wrote to memory of 464 2284 explorer.exe 111 PID 2284 wrote to memory of 3152 2284 explorer.exe 112 PID 2284 wrote to memory of 3152 2284 explorer.exe 112 PID 2284 wrote to memory of 3152 2284 explorer.exe 112 PID 2284 wrote to memory of 2436 2284 explorer.exe 113 PID 2284 wrote to memory of 2436 2284 explorer.exe 113 PID 2284 wrote to memory of 2436 2284 explorer.exe 113 PID 2284 wrote to memory of 2888 2284 explorer.exe 114 PID 2284 wrote to memory of 2888 2284 explorer.exe 114 PID 2284 wrote to memory of 2888 2284 explorer.exe 114 PID 2284 wrote to memory of 3364 2284 explorer.exe 115 PID 2284 wrote to memory of 3364 2284 explorer.exe 115 PID 2284 wrote to memory of 3364 2284 explorer.exe 115 PID 2284 wrote to memory of 3224 2284 explorer.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1808dcf7c396b14857d25dbdb109c0b_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3916 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4332 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1604
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1960 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4260
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2584
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1696 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4468 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3172 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:348 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3200
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4344
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:740 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4432 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3740
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3136
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3552 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
PID:1104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3240
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4212 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2824
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2092 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4704 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:3236 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5432
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3872 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3472 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:6044
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5112
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
PID:820 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4136
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2268
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1632
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3324 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4288
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2332
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:912
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4292
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:3712 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5576 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5644
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3752 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5936 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6016
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:6092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5828
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5868
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5988
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3444 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:6068
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4924 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5636 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:5704
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4996
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4128
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4672
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4144
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4384
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4976
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2644
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5264
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:5156
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2720
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2212
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2196
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4756
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5e7b71994514b163059df7abe50cd167b
SHA17a05f71af306f68d9a8324e42c1f0ae2f87ee151
SHA2567874b9734ea1eeef5989559244137618761ed7f108baf772a7b9c7172e0e4aff
SHA512e77e25ab7ce95f5ad563c4f7e85dead5f1ed663551359f8e135a5f6834187572ece5e1d705e3a187276a806ac22ae706293c29a6da4f7b771ddc74d1b25e2db6
-
Filesize
2.2MB
MD5f478a1aad6f06edfe75fdd7916dfe1b6
SHA1ed0630b56f31f080b6e557c6d8bfb2f950d41d83
SHA2566aafb2c4ed70a2a67b8c82b340cd95f89bef08ec5ef1683638c1ee48d57e2477
SHA5120f762dc77243f0d519188d95e887649c5372506894017163588b17bdefba40d49e180273f92adc81ed6bb1723e9737f3d718f43cded1164c8541bfc205dfe6b0