Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 11:11
Behavioral task
behavioral1
Sample
fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
fc2d6f1ba380329d8646c6e867cdf721
-
SHA1
60779ad6ff0f560d3ac873837da6c44963b5dedb
-
SHA256
ea597635b5051e2495eddb21add1d714455ec8e4c968946e59b19c32c306a520
-
SHA512
9f4cd8465270eae73b41fea1978ad32abed2accf5953df7fe1673e69c44b8506df1b282f969aed98fc407bb98927e085571c4b2dd68685990f05e06603a13668
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZO:0UzeyQMS4DqodCnoe+iitjWwwy
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2632 explorer.exe 2728 explorer.exe 2892 spoolsv.exe 1532 spoolsv.exe 2500 spoolsv.exe 1588 spoolsv.exe 1916 spoolsv.exe 2792 spoolsv.exe 2204 spoolsv.exe 2996 spoolsv.exe 2916 spoolsv.exe 2560 spoolsv.exe 2464 spoolsv.exe 1944 spoolsv.exe 2432 spoolsv.exe 2944 spoolsv.exe 2400 spoolsv.exe 2212 spoolsv.exe 2912 spoolsv.exe 2468 spoolsv.exe 2044 spoolsv.exe 2860 spoolsv.exe 2640 spoolsv.exe 2632 spoolsv.exe 2012 spoolsv.exe 2144 spoolsv.exe 1488 spoolsv.exe 2780 spoolsv.exe 2056 spoolsv.exe 2836 spoolsv.exe 2380 spoolsv.exe 2492 spoolsv.exe 2852 spoolsv.exe 2652 spoolsv.exe 2172 spoolsv.exe 2368 spoolsv.exe 1020 spoolsv.exe 2424 spoolsv.exe 2344 spoolsv.exe 1648 spoolsv.exe 2128 spoolsv.exe 1408 spoolsv.exe 2732 spoolsv.exe 2736 spoolsv.exe 2480 spoolsv.exe 872 spoolsv.exe 2132 spoolsv.exe 320 spoolsv.exe 1080 spoolsv.exe 1288 spoolsv.exe 2116 spoolsv.exe 472 spoolsv.exe 2276 spoolsv.exe 2220 spoolsv.exe 3012 spoolsv.exe 2404 explorer.exe 2840 spoolsv.exe 2960 spoolsv.exe 2648 spoolsv.exe 836 spoolsv.exe 524 explorer.exe 2416 spoolsv.exe 3168 spoolsv.exe 3228 spoolsv.exe -
Loads dropped DLL 64 IoCs
pid Process 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 23 IoCs
description pid Process procid_target PID 396 set thread context of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 2632 set thread context of 2728 2632 explorer.exe 32 PID 1532 set thread context of 2220 1532 spoolsv.exe 85 PID 2892 set thread context of 3012 2892 spoolsv.exe 84 PID 1588 set thread context of 2840 1588 spoolsv.exe 87 PID 2500 set thread context of 2960 2500 spoolsv.exe 88 PID 2792 set thread context of 836 2792 spoolsv.exe 90 PID 1916 set thread context of 2416 1916 spoolsv.exe 91 PID 2996 set thread context of 3228 2996 spoolsv.exe 94 PID 2204 set thread context of 3480 2204 spoolsv.exe 95 PID 2560 set thread context of 3664 2560 spoolsv.exe 96 PID 2916 set thread context of 3816 2916 spoolsv.exe 99 PID 1944 set thread context of 3856 1944 spoolsv.exe 100 PID 2464 set thread context of 3864 2464 spoolsv.exe 101 PID 2944 set thread context of 4092 2944 spoolsv.exe 102 PID 2432 set thread context of 3080 2432 spoolsv.exe 103 PID 2400 set thread context of 3292 2400 spoolsv.exe 104 PID 2212 set thread context of 3300 2212 spoolsv.exe 105 PID 2468 set thread context of 3308 2468 spoolsv.exe 106 PID 2912 set thread context of 3376 2912 spoolsv.exe 109 PID 2860 set thread context of 3700 2860 spoolsv.exe 110 PID 2044 set thread context of 3860 2044 spoolsv.exe 111 PID 2632 set thread context of 3888 2632 spoolsv.exe 112 -
Drops file in Windows directory 57 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 explorer.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
pid Process 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2728 explorer.exe 2220 spoolsv.exe 3012 spoolsv.exe 2220 spoolsv.exe 3012 spoolsv.exe 2840 spoolsv.exe 2840 spoolsv.exe 2960 spoolsv.exe 2960 spoolsv.exe 836 spoolsv.exe 836 spoolsv.exe 2416 spoolsv.exe 2416 spoolsv.exe 3228 spoolsv.exe 3228 spoolsv.exe 3480 spoolsv.exe 3480 spoolsv.exe 3664 spoolsv.exe 3664 spoolsv.exe 3816 spoolsv.exe 3816 spoolsv.exe 3856 spoolsv.exe 3856 spoolsv.exe 3864 spoolsv.exe 3864 spoolsv.exe 4092 spoolsv.exe 4092 spoolsv.exe 3080 spoolsv.exe 3080 spoolsv.exe 3292 spoolsv.exe 3292 spoolsv.exe 3300 spoolsv.exe 3300 spoolsv.exe 3308 spoolsv.exe 3308 spoolsv.exe 3376 spoolsv.exe 3376 spoolsv.exe 3700 spoolsv.exe 3700 spoolsv.exe 3860 spoolsv.exe 3860 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 396 wrote to memory of 1800 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 29 PID 396 wrote to memory of 1800 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 29 PID 396 wrote to memory of 1800 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 29 PID 396 wrote to memory of 1800 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 29 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 396 wrote to memory of 2976 396 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 30 PID 2976 wrote to memory of 2632 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 31 PID 2976 wrote to memory of 2632 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 31 PID 2976 wrote to memory of 2632 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 31 PID 2976 wrote to memory of 2632 2976 fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe 31 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2632 wrote to memory of 2728 2632 explorer.exe 32 PID 2728 wrote to memory of 2892 2728 explorer.exe 33 PID 2728 wrote to memory of 2892 2728 explorer.exe 33 PID 2728 wrote to memory of 2892 2728 explorer.exe 33 PID 2728 wrote to memory of 2892 2728 explorer.exe 33 PID 2728 wrote to memory of 1532 2728 explorer.exe 34 PID 2728 wrote to memory of 1532 2728 explorer.exe 34 PID 2728 wrote to memory of 1532 2728 explorer.exe 34 PID 2728 wrote to memory of 1532 2728 explorer.exe 34 PID 2728 wrote to memory of 2500 2728 explorer.exe 35 PID 2728 wrote to memory of 2500 2728 explorer.exe 35 PID 2728 wrote to memory of 2500 2728 explorer.exe 35 PID 2728 wrote to memory of 2500 2728 explorer.exe 35 PID 2728 wrote to memory of 1588 2728 explorer.exe 36 PID 2728 wrote to memory of 1588 2728 explorer.exe 36 PID 2728 wrote to memory of 1588 2728 explorer.exe 36 PID 2728 wrote to memory of 1588 2728 explorer.exe 36 PID 2728 wrote to memory of 1916 2728 explorer.exe 37 PID 2728 wrote to memory of 1916 2728 explorer.exe 37 PID 2728 wrote to memory of 1916 2728 explorer.exe 37 PID 2728 wrote to memory of 1916 2728 explorer.exe 37 PID 2728 wrote to memory of 2792 2728 explorer.exe 38 PID 2728 wrote to memory of 2792 2728 explorer.exe 38 PID 2728 wrote to memory of 2792 2728 explorer.exe 38 PID 2728 wrote to memory of 2792 2728 explorer.exe 38 PID 2728 wrote to memory of 2204 2728 explorer.exe 39 PID 2728 wrote to memory of 2204 2728 explorer.exe 39 PID 2728 wrote to memory of 2204 2728 explorer.exe 39 PID 2728 wrote to memory of 2204 2728 explorer.exe 39 PID 2728 wrote to memory of 2996 2728 explorer.exe 40 PID 2728 wrote to memory of 2996 2728 explorer.exe 40 PID 2728 wrote to memory of 2996 2728 explorer.exe 40 PID 2728 wrote to memory of 2996 2728 explorer.exe 40 PID 2728 wrote to memory of 2916 2728 explorer.exe 41 PID 2728 wrote to memory of 2916 2728 explorer.exe 41 PID 2728 wrote to memory of 2916 2728 explorer.exe 41 PID 2728 wrote to memory of 2916 2728 explorer.exe 41 PID 2728 wrote to memory of 2560 2728 explorer.exe 42 PID 2728 wrote to memory of 2560 2728 explorer.exe 42 PID 2728 wrote to memory of 2560 2728 explorer.exe 42 PID 2728 wrote to memory of 2560 2728 explorer.exe 42 PID 2728 wrote to memory of 2464 2728 explorer.exe 43 PID 2728 wrote to memory of 2464 2728 explorer.exe 43 PID 2728 wrote to memory of 2464 2728 explorer.exe 43 PID 2728 wrote to memory of 2464 2728 explorer.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc2d6f1ba380329d8646c6e867cdf721_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2220 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:836 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:524
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3664 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:3752
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3864
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3292
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:3636
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3700
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3888
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3104
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1488 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3124
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3744
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3360
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3284
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3536
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1164
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1020 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2824
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2344 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3032
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3240
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3328
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2868
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1408 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3944
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1688
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3368
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2832
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3076
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4044
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4056
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3288
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:3168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3776
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:3540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3872
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD58c878e45188839763d0791ca763956a5
SHA11c0b063f02546b85f1f647946bb5b5fc02bfd61a
SHA2567e941755066a47bccbd897a69151fdb9d78b0e25b4e556cf7fec86036582e3a0
SHA512001bb7a5d086b86b704ac07f0d61b3b055c22c0eb3cd79f94157e39767acba67af522f798ef953866a07305683e1a2b0ad477fff199ff8f6fb433e01e60d7b71
-
Filesize
2.2MB
MD54a28c61b87a08cb0aea8476866c208f0
SHA1666672af7a117da749ac31b1620399fca07f303e
SHA256303130e9c55a869c0597ea876e616e6af031261feaf76ddde396896b060587fb
SHA512976249ce558ae7484a1c26716479faa32e9b192fccbb3fa224e17d8be926cd052ba5cf33b6e7a55de26283b4b05528462a8175b401ae1e4af1d77d8f8424e4e7