Analysis
-
max time kernel
135s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 18:27
Behavioral task
behavioral1
Sample
e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
e9b9e0bfa4b22ded42edd3838a63a895
-
SHA1
8578a46f84ecd1ef619f506678fe99e6a189bc70
-
SHA256
6ea8916714a4e6d345554dc48cfe30d2732333d90044840e68d276a7c100dca5
-
SHA512
7494fbbc6e44b302d2ea67830490be1a2185b73dcb1788335abb24a114e1c7c5a3a799a2f518aa87d0fad47a23f3fd4635bdaadc4ce32bcd665fc8317434f3ec
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWwwW
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1376 explorer.exe 3740 explorer.exe 632 spoolsv.exe 1284 spoolsv.exe 1624 spoolsv.exe 4208 spoolsv.exe 4940 spoolsv.exe 2680 spoolsv.exe 1380 spoolsv.exe 4248 spoolsv.exe 216 spoolsv.exe 4460 spoolsv.exe 2564 spoolsv.exe 548 spoolsv.exe 2864 spoolsv.exe 920 spoolsv.exe 968 spoolsv.exe 4268 spoolsv.exe 1992 spoolsv.exe 856 spoolsv.exe 3912 spoolsv.exe 5076 spoolsv.exe 2224 spoolsv.exe 640 spoolsv.exe 4004 spoolsv.exe 3708 spoolsv.exe 232 spoolsv.exe 1328 spoolsv.exe 2372 spoolsv.exe 4908 spoolsv.exe 4172 spoolsv.exe 5012 spoolsv.exe 4852 explorer.exe 2516 spoolsv.exe 2124 spoolsv.exe 4812 spoolsv.exe 2900 spoolsv.exe 2020 spoolsv.exe 1876 explorer.exe 4916 spoolsv.exe 1856 spoolsv.exe 1252 spoolsv.exe 2476 spoolsv.exe 1272 explorer.exe 3208 spoolsv.exe 1984 spoolsv.exe 4560 spoolsv.exe 4264 spoolsv.exe 2220 explorer.exe 2124 spoolsv.exe 4364 spoolsv.exe 1868 spoolsv.exe 5104 spoolsv.exe 1308 explorer.exe 4048 spoolsv.exe 1928 spoolsv.exe 2884 spoolsv.exe 1736 spoolsv.exe 1012 spoolsv.exe 5116 explorer.exe 3508 spoolsv.exe 4552 spoolsv.exe 4596 spoolsv.exe 1124 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 44 IoCs
description pid Process procid_target PID 1932 set thread context of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 1376 set thread context of 3740 1376 explorer.exe 95 PID 632 set thread context of 5012 632 spoolsv.exe 125 PID 1284 set thread context of 2516 1284 spoolsv.exe 127 PID 1624 set thread context of 2124 1624 spoolsv.exe 128 PID 4208 set thread context of 4812 4208 spoolsv.exe 129 PID 4940 set thread context of 2020 4940 spoolsv.exe 131 PID 2680 set thread context of 4916 2680 spoolsv.exe 133 PID 1380 set thread context of 1856 1380 spoolsv.exe 134 PID 4248 set thread context of 2476 4248 spoolsv.exe 136 PID 216 set thread context of 3208 216 spoolsv.exe 138 PID 4460 set thread context of 1984 4460 spoolsv.exe 139 PID 2564 set thread context of 4264 2564 spoolsv.exe 141 PID 548 set thread context of 2124 548 spoolsv.exe 143 PID 2864 set thread context of 4364 2864 spoolsv.exe 144 PID 920 set thread context of 5104 920 spoolsv.exe 146 PID 968 set thread context of 4048 968 spoolsv.exe 148 PID 4268 set thread context of 1928 4268 spoolsv.exe 149 PID 1992 set thread context of 2884 1992 spoolsv.exe 150 PID 856 set thread context of 1012 856 spoolsv.exe 152 PID 3912 set thread context of 3508 3912 spoolsv.exe 154 PID 5076 set thread context of 4552 5076 spoolsv.exe 155 PID 2224 set thread context of 1124 2224 spoolsv.exe 157 PID 640 set thread context of 2200 640 spoolsv.exe 159 PID 4004 set thread context of 852 4004 spoolsv.exe 160 PID 3708 set thread context of 5000 3708 spoolsv.exe 162 PID 232 set thread context of 4544 232 spoolsv.exe 163 PID 1328 set thread context of 4252 1328 spoolsv.exe 165 PID 2372 set thread context of 3128 2372 spoolsv.exe 166 PID 4908 set thread context of 4580 4908 spoolsv.exe 168 PID 4852 set thread context of 1768 4852 explorer.exe 171 PID 4172 set thread context of 1912 4172 spoolsv.exe 172 PID 1876 set thread context of 3368 1876 explorer.exe 175 PID 2900 set thread context of 3144 2900 spoolsv.exe 176 PID 1252 set thread context of 388 1252 spoolsv.exe 180 PID 1272 set thread context of 4704 1272 explorer.exe 183 PID 4560 set thread context of 2704 4560 spoolsv.exe 185 PID 2220 set thread context of 4620 2220 explorer.exe 187 PID 1868 set thread context of 3728 1868 spoolsv.exe 190 PID 1308 set thread context of 1168 1308 explorer.exe 192 PID 1736 set thread context of 1188 1736 spoolsv.exe 196 PID 5116 set thread context of 1600 5116 explorer.exe 198 PID 4596 set thread context of 2400 4596 spoolsv.exe 201 PID 3132 set thread context of 3752 3132 explorer.exe 203 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3740 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 5012 spoolsv.exe 5012 spoolsv.exe 2516 spoolsv.exe 2516 spoolsv.exe 2124 spoolsv.exe 2124 spoolsv.exe 4812 spoolsv.exe 4812 spoolsv.exe 2020 spoolsv.exe 2020 spoolsv.exe 4916 spoolsv.exe 4916 spoolsv.exe 1856 spoolsv.exe 1856 spoolsv.exe 2476 spoolsv.exe 2476 spoolsv.exe 3208 spoolsv.exe 3208 spoolsv.exe 1984 spoolsv.exe 1984 spoolsv.exe 4264 spoolsv.exe 4264 spoolsv.exe 2124 spoolsv.exe 2124 spoolsv.exe 4364 spoolsv.exe 4364 spoolsv.exe 5104 spoolsv.exe 5104 spoolsv.exe 4048 spoolsv.exe 4048 spoolsv.exe 1928 spoolsv.exe 1928 spoolsv.exe 2884 spoolsv.exe 2884 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 3508 spoolsv.exe 3508 spoolsv.exe 4552 spoolsv.exe 4552 spoolsv.exe 1124 spoolsv.exe 1124 spoolsv.exe 2200 spoolsv.exe 2200 spoolsv.exe 852 spoolsv.exe 852 spoolsv.exe 5000 spoolsv.exe 5000 spoolsv.exe 4544 spoolsv.exe 4544 spoolsv.exe 4252 spoolsv.exe 4252 spoolsv.exe 3128 spoolsv.exe 3128 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 1768 explorer.exe 1768 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2468 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 82 PID 1932 wrote to memory of 2468 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 82 PID 1932 wrote to memory of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 1932 wrote to memory of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 1932 wrote to memory of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 1932 wrote to memory of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 1932 wrote to memory of 2324 1932 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 91 PID 2324 wrote to memory of 1376 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 92 PID 2324 wrote to memory of 1376 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 92 PID 2324 wrote to memory of 1376 2324 e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe 92 PID 1376 wrote to memory of 3740 1376 explorer.exe 95 PID 1376 wrote to memory of 3740 1376 explorer.exe 95 PID 1376 wrote to memory of 3740 1376 explorer.exe 95 PID 1376 wrote to memory of 3740 1376 explorer.exe 95 PID 1376 wrote to memory of 3740 1376 explorer.exe 95 PID 3740 wrote to memory of 632 3740 explorer.exe 96 PID 3740 wrote to memory of 632 3740 explorer.exe 96 PID 3740 wrote to memory of 632 3740 explorer.exe 96 PID 3740 wrote to memory of 1284 3740 explorer.exe 97 PID 3740 wrote to memory of 1284 3740 explorer.exe 97 PID 3740 wrote to memory of 1284 3740 explorer.exe 97 PID 3740 wrote to memory of 1624 3740 explorer.exe 98 PID 3740 wrote to memory of 1624 3740 explorer.exe 98 PID 3740 wrote to memory of 1624 3740 explorer.exe 98 PID 3740 wrote to memory of 4208 3740 explorer.exe 99 PID 3740 wrote to memory of 4208 3740 explorer.exe 99 PID 3740 wrote to memory of 4208 3740 explorer.exe 99 PID 3740 wrote to memory of 4940 3740 explorer.exe 100 PID 3740 wrote to memory of 4940 3740 explorer.exe 100 PID 3740 wrote to memory of 4940 3740 explorer.exe 100 PID 3740 wrote to memory of 2680 3740 explorer.exe 101 PID 3740 wrote to memory of 2680 3740 explorer.exe 101 PID 3740 wrote to memory of 2680 3740 explorer.exe 101 PID 3740 wrote to memory of 1380 3740 explorer.exe 102 PID 3740 wrote to memory of 1380 3740 explorer.exe 102 PID 3740 wrote to memory of 1380 3740 explorer.exe 102 PID 3740 wrote to memory of 4248 3740 explorer.exe 103 PID 3740 wrote to memory of 4248 3740 explorer.exe 103 PID 3740 wrote to memory of 4248 3740 explorer.exe 103 PID 3740 wrote to memory of 216 3740 explorer.exe 104 PID 3740 wrote to memory of 216 3740 explorer.exe 104 PID 3740 wrote to memory of 216 3740 explorer.exe 104 PID 3740 wrote to memory of 4460 3740 explorer.exe 105 PID 3740 wrote to memory of 4460 3740 explorer.exe 105 PID 3740 wrote to memory of 4460 3740 explorer.exe 105 PID 3740 wrote to memory of 2564 3740 explorer.exe 106 PID 3740 wrote to memory of 2564 3740 explorer.exe 106 PID 3740 wrote to memory of 2564 3740 explorer.exe 106 PID 3740 wrote to memory of 548 3740 explorer.exe 107 PID 3740 wrote to memory of 548 3740 explorer.exe 107 PID 3740 wrote to memory of 548 3740 explorer.exe 107 PID 3740 wrote to memory of 2864 3740 explorer.exe 108 PID 3740 wrote to memory of 2864 3740 explorer.exe 108 PID 3740 wrote to memory of 2864 3740 explorer.exe 108 PID 3740 wrote to memory of 920 3740 explorer.exe 109 PID 3740 wrote to memory of 920 3740 explorer.exe 109 PID 3740 wrote to memory of 920 3740 explorer.exe 109 PID 3740 wrote to memory of 968 3740 explorer.exe 110 PID 3740 wrote to memory of 968 3740 explorer.exe 110 PID 3740 wrote to memory of 968 3740 explorer.exe 110 PID 3740 wrote to memory of 4268 3740 explorer.exe 111 PID 3740 wrote to memory of 4268 3740 explorer.exe 111 PID 3740 wrote to memory of 4268 3740 explorer.exe 111 PID 3740 wrote to memory of 1992 3740 explorer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9b9e0bfa4b22ded42edd3838a63a895_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5012 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2516
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2020 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1876 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2476 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1272 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4704
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3208
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4620
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4364
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5104 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1308 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:1168
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1012 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5116 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1600
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4552
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1124 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3752
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4004 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:852
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:232 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4544 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4028 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2228
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4252
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3128
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4908 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1912
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2416 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4168
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3144
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5084
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:388
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4944
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:436
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1868 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3728
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:512
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1188 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2732
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:800
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:64 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4936
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4284
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1004
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1932
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4980 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3460
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2960
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:1172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3000
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2532
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3136
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4720
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1068
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1112
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2184
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1332
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3268
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4968
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1116
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:972
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3212
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3420
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52eb62b856172fa0ed7838e78f53daffd
SHA1d54ab4504dc55ce1af2809121aafc38b7f8f7155
SHA256db480e2871ac8ec81109c46d6d9262c720145d91315ea81e7a4f28c998423327
SHA51241ac80ecb79717d1d78a39de09a137d9157bfe33302fc7339afc82dd4b17de0432579df2384c79a2f4ce91df3b16689ba1d823eb9b255cfc4f2b2876e8b67183
-
Filesize
2.2MB
MD567f23f5b8f57630e972e903a05f4fa59
SHA1f7fe1497976fa112d977e9119ceba9c7e2842439
SHA2567f1317220a921955d80883154797a1087a8335fc3559e01f339440e6224f1241
SHA51289dccba91eb5b3251d3ce431fcbfe56a818d0f8db19762efeaedf30aae2bd230c96f1cc88bf54bbe8bba357961b30ced84172714b13b674a9ef81fa6bd7c1f06