Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 23:14
Behavioral task
behavioral1
Sample
fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
fb13e5ac505671b438776820e5e6cf6a
-
SHA1
762d2f4f217977c64808509870a5e6707a5fc4a5
-
SHA256
cef046261dcaef0ffaa46e04dafb06c6c579769801ff5f9eafed8e011d1566fa
-
SHA512
23b60ee0d7420bbbbe22a0ca467efed15d6c2ef38c1d6b1b39936894bc3d272692ef6a1127c3c2313dc265900624c6c862a213ea72d5c4693370a26bd5679159
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWwwg
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3292 explorer.exe 2908 explorer.exe 4076 spoolsv.exe 1200 spoolsv.exe 2368 spoolsv.exe 556 spoolsv.exe 4572 spoolsv.exe 900 spoolsv.exe 4776 spoolsv.exe 3312 spoolsv.exe 3548 spoolsv.exe 4140 spoolsv.exe 3112 spoolsv.exe 5044 spoolsv.exe 1992 spoolsv.exe 4808 spoolsv.exe 3316 spoolsv.exe 2212 spoolsv.exe 4120 spoolsv.exe 2432 spoolsv.exe 1328 spoolsv.exe 3064 spoolsv.exe 2920 spoolsv.exe 2480 spoolsv.exe 4256 spoolsv.exe 3816 spoolsv.exe 1400 spoolsv.exe 1588 spoolsv.exe 3792 spoolsv.exe 5032 spoolsv.exe 1844 spoolsv.exe 4888 spoolsv.exe 3264 spoolsv.exe 3864 explorer.exe 808 spoolsv.exe 4012 spoolsv.exe 4108 spoolsv.exe 4352 spoolsv.exe 4192 spoolsv.exe 2736 spoolsv.exe 3164 explorer.exe 2280 spoolsv.exe 2108 spoolsv.exe 2600 spoolsv.exe 3760 spoolsv.exe 4104 spoolsv.exe 220 explorer.exe 1436 spoolsv.exe 3304 spoolsv.exe 3872 spoolsv.exe 4708 spoolsv.exe 1224 spoolsv.exe 1180 explorer.exe 1464 spoolsv.exe 4740 spoolsv.exe 1012 spoolsv.exe 944 spoolsv.exe 4264 spoolsv.exe 3688 explorer.exe 4508 spoolsv.exe 2752 spoolsv.exe 1504 spoolsv.exe 2788 spoolsv.exe 4240 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 39 IoCs
description pid Process procid_target PID 748 set thread context of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 3292 set thread context of 2908 3292 explorer.exe 95 PID 4076 set thread context of 3264 4076 spoolsv.exe 126 PID 1200 set thread context of 808 1200 spoolsv.exe 128 PID 2368 set thread context of 4012 2368 spoolsv.exe 129 PID 556 set thread context of 4108 556 spoolsv.exe 130 PID 4572 set thread context of 4352 4572 spoolsv.exe 131 PID 900 set thread context of 2736 900 spoolsv.exe 133 PID 4776 set thread context of 2280 4776 spoolsv.exe 135 PID 3312 set thread context of 2108 3312 spoolsv.exe 136 PID 3548 set thread context of 2600 3548 spoolsv.exe 137 PID 4140 set thread context of 4104 4140 spoolsv.exe 139 PID 3112 set thread context of 1436 3112 spoolsv.exe 141 PID 5044 set thread context of 3304 5044 spoolsv.exe 142 PID 1992 set thread context of 3872 1992 spoolsv.exe 143 PID 4808 set thread context of 1224 4808 spoolsv.exe 145 PID 3316 set thread context of 1464 3316 spoolsv.exe 147 PID 2212 set thread context of 4740 2212 spoolsv.exe 148 PID 4120 set thread context of 1012 4120 spoolsv.exe 149 PID 2432 set thread context of 4264 2432 spoolsv.exe 151 PID 1328 set thread context of 4508 1328 spoolsv.exe 153 PID 3064 set thread context of 2752 3064 spoolsv.exe 154 PID 2920 set thread context of 2788 2920 spoolsv.exe 156 PID 2480 set thread context of 4240 2480 spoolsv.exe 157 PID 4256 set thread context of 8 4256 spoolsv.exe 159 PID 3816 set thread context of 4824 3816 spoolsv.exe 161 PID 1400 set thread context of 2648 1400 spoolsv.exe 162 PID 1588 set thread context of 856 1588 spoolsv.exe 164 PID 3792 set thread context of 3500 3792 spoolsv.exe 165 PID 5032 set thread context of 1220 5032 spoolsv.exe 166 PID 1844 set thread context of 2972 1844 spoolsv.exe 168 PID 4888 set thread context of 2152 4888 spoolsv.exe 173 PID 3864 set thread context of 3520 3864 explorer.exe 175 PID 4192 set thread context of 5116 4192 spoolsv.exe 178 PID 3164 set thread context of 2984 3164 explorer.exe 180 PID 3760 set thread context of 2708 3760 spoolsv.exe 184 PID 220 set thread context of 2732 220 explorer.exe 186 PID 4708 set thread context of 4144 4708 spoolsv.exe 188 PID 1180 set thread context of 4584 1180 explorer.exe 191 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 3264 spoolsv.exe 3264 spoolsv.exe 808 spoolsv.exe 808 spoolsv.exe 4012 spoolsv.exe 4012 spoolsv.exe 4108 spoolsv.exe 4108 spoolsv.exe 4352 spoolsv.exe 4352 spoolsv.exe 2736 spoolsv.exe 2736 spoolsv.exe 2280 spoolsv.exe 2280 spoolsv.exe 2108 spoolsv.exe 2108 spoolsv.exe 2600 spoolsv.exe 2600 spoolsv.exe 4104 spoolsv.exe 4104 spoolsv.exe 1436 spoolsv.exe 1436 spoolsv.exe 3304 spoolsv.exe 3304 spoolsv.exe 3872 spoolsv.exe 3872 spoolsv.exe 1224 spoolsv.exe 1224 spoolsv.exe 1464 spoolsv.exe 1464 spoolsv.exe 4740 spoolsv.exe 4740 spoolsv.exe 1012 spoolsv.exe 1012 spoolsv.exe 4264 spoolsv.exe 4264 spoolsv.exe 4508 spoolsv.exe 4508 spoolsv.exe 2752 spoolsv.exe 2752 spoolsv.exe 2788 spoolsv.exe 2788 spoolsv.exe 4240 spoolsv.exe 4240 spoolsv.exe 8 spoolsv.exe 8 spoolsv.exe 4824 spoolsv.exe 4824 spoolsv.exe 2648 spoolsv.exe 2648 spoolsv.exe 856 spoolsv.exe 856 spoolsv.exe 3500 spoolsv.exe 3500 spoolsv.exe 1220 spoolsv.exe 1220 spoolsv.exe 2972 spoolsv.exe 2972 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 748 wrote to memory of 4004 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 82 PID 748 wrote to memory of 4004 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 82 PID 748 wrote to memory of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 748 wrote to memory of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 748 wrote to memory of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 748 wrote to memory of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 748 wrote to memory of 2940 748 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 91 PID 2940 wrote to memory of 3292 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 92 PID 2940 wrote to memory of 3292 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 92 PID 2940 wrote to memory of 3292 2940 fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe 92 PID 3292 wrote to memory of 2908 3292 explorer.exe 95 PID 3292 wrote to memory of 2908 3292 explorer.exe 95 PID 3292 wrote to memory of 2908 3292 explorer.exe 95 PID 3292 wrote to memory of 2908 3292 explorer.exe 95 PID 3292 wrote to memory of 2908 3292 explorer.exe 95 PID 2908 wrote to memory of 4076 2908 explorer.exe 96 PID 2908 wrote to memory of 4076 2908 explorer.exe 96 PID 2908 wrote to memory of 4076 2908 explorer.exe 96 PID 2908 wrote to memory of 1200 2908 explorer.exe 97 PID 2908 wrote to memory of 1200 2908 explorer.exe 97 PID 2908 wrote to memory of 1200 2908 explorer.exe 97 PID 2908 wrote to memory of 2368 2908 explorer.exe 98 PID 2908 wrote to memory of 2368 2908 explorer.exe 98 PID 2908 wrote to memory of 2368 2908 explorer.exe 98 PID 2908 wrote to memory of 556 2908 explorer.exe 99 PID 2908 wrote to memory of 556 2908 explorer.exe 99 PID 2908 wrote to memory of 556 2908 explorer.exe 99 PID 2908 wrote to memory of 4572 2908 explorer.exe 100 PID 2908 wrote to memory of 4572 2908 explorer.exe 100 PID 2908 wrote to memory of 4572 2908 explorer.exe 100 PID 2908 wrote to memory of 900 2908 explorer.exe 101 PID 2908 wrote to memory of 900 2908 explorer.exe 101 PID 2908 wrote to memory of 900 2908 explorer.exe 101 PID 2908 wrote to memory of 4776 2908 explorer.exe 102 PID 2908 wrote to memory of 4776 2908 explorer.exe 102 PID 2908 wrote to memory of 4776 2908 explorer.exe 102 PID 2908 wrote to memory of 3312 2908 explorer.exe 103 PID 2908 wrote to memory of 3312 2908 explorer.exe 103 PID 2908 wrote to memory of 3312 2908 explorer.exe 103 PID 2908 wrote to memory of 3548 2908 explorer.exe 104 PID 2908 wrote to memory of 3548 2908 explorer.exe 104 PID 2908 wrote to memory of 3548 2908 explorer.exe 104 PID 2908 wrote to memory of 4140 2908 explorer.exe 105 PID 2908 wrote to memory of 4140 2908 explorer.exe 105 PID 2908 wrote to memory of 4140 2908 explorer.exe 105 PID 2908 wrote to memory of 3112 2908 explorer.exe 106 PID 2908 wrote to memory of 3112 2908 explorer.exe 106 PID 2908 wrote to memory of 3112 2908 explorer.exe 106 PID 2908 wrote to memory of 5044 2908 explorer.exe 107 PID 2908 wrote to memory of 5044 2908 explorer.exe 107 PID 2908 wrote to memory of 5044 2908 explorer.exe 107 PID 2908 wrote to memory of 1992 2908 explorer.exe 108 PID 2908 wrote to memory of 1992 2908 explorer.exe 108 PID 2908 wrote to memory of 1992 2908 explorer.exe 108 PID 2908 wrote to memory of 4808 2908 explorer.exe 109 PID 2908 wrote to memory of 4808 2908 explorer.exe 109 PID 2908 wrote to memory of 4808 2908 explorer.exe 109 PID 2908 wrote to memory of 3316 2908 explorer.exe 110 PID 2908 wrote to memory of 3316 2908 explorer.exe 110 PID 2908 wrote to memory of 3316 2908 explorer.exe 110 PID 2908 wrote to memory of 2212 2908 explorer.exe 111 PID 2908 wrote to memory of 2212 2908 explorer.exe 111 PID 2908 wrote to memory of 2212 2908 explorer.exe 111 PID 2908 wrote to memory of 4120 2908 explorer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb13e5ac505671b438776820e5e6cf6a_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4076 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3864 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:3520
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:808
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2736 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3164 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2984
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3312 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3548 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4104 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:220 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2732
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4808 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1224 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1180 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4584
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4740
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3688 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4484
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4240 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4152 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1516
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3816 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2648 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3004 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:916
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2972 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4336 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4888 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2152
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4468 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4232
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5116 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:2892 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4300
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4708 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4144
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4992
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1984
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3088
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2440
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:388
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1076
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2868
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:212
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:692
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2552
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1792
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4296
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5104
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:60
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4456
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3640
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1240
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3604
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4876
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2340
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2292
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2196
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:448
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2720
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD50ff1fb42de8fc2eddb26d55d0d25584a
SHA1ee736e61561e828fb0cf1606279f26f88981f5a9
SHA2564c34cbae38111165e8eacd724b7902e54c200503d161f031c35776934c1ca261
SHA51216e08cea487057be707e167d0acc94089bdecb29bf8d8d9939cc4ea1640305e9afa49335199620dcb206232a3a318f64200d1ab249d1894e0e3511b1fde986c3
-
Filesize
2.2MB
MD54cba8e07c8e80ef93d4a897951d38df7
SHA14bffca465c1816d06930c90a1f6c37ab0c1b8415
SHA256d2c774ad2f719ac64e0ac8b5ecf00a734b9441e47820d04e8b57fb4d44034b7f
SHA5120d4e2b753c5fa2359038df3e5f3ec6a4d5a580e9de136ca2a1689b275f63fe11225c7c75d18b6091b2cfc64425d69946908d770dc975c2dccb178c45a4b5cd1a