Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 02:23
Behavioral task
behavioral1
Sample
fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
fd9d3865941e3b86cc01caecdfb2ce7b
-
SHA1
a22ce3692d1e6834b08248348bdbaa6ee29adcd9
-
SHA256
0a2ced28035e1ae1bce45d974097baacb6acedbdaf63bd83015a17d389164c32
-
SHA512
22996674e3bcb14ab275ad5a7bfb52ce5ae6ea109bdfbd4cad306b359a5a2cb86ce04a8d98ca38f2b00e9d0073abbe380162414c1be5d036c8e62b55fd068bdc
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwT
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3228 explorer.exe 1876 explorer.exe 4720 spoolsv.exe 3568 spoolsv.exe 4432 spoolsv.exe 1508 spoolsv.exe 4800 spoolsv.exe 740 spoolsv.exe 3132 spoolsv.exe 3416 spoolsv.exe 3748 spoolsv.exe 2536 spoolsv.exe 640 spoolsv.exe 2068 spoolsv.exe 2644 spoolsv.exe 2940 spoolsv.exe 1472 spoolsv.exe 1636 spoolsv.exe 4316 spoolsv.exe 1464 spoolsv.exe 4364 spoolsv.exe 1252 spoolsv.exe 948 spoolsv.exe 1416 spoolsv.exe 2944 spoolsv.exe 1412 spoolsv.exe 904 spoolsv.exe 2932 spoolsv.exe 4320 spoolsv.exe 2452 spoolsv.exe 4592 spoolsv.exe 5040 spoolsv.exe 1212 spoolsv.exe 1108 explorer.exe 3820 spoolsv.exe 2884 spoolsv.exe 2488 spoolsv.exe 400 spoolsv.exe 2120 spoolsv.exe 2360 spoolsv.exe 3428 explorer.exe 3492 spoolsv.exe 2348 spoolsv.exe 4116 spoolsv.exe 1280 spoolsv.exe 4812 spoolsv.exe 4192 spoolsv.exe 2252 explorer.exe 4376 spoolsv.exe 2472 spoolsv.exe 3520 spoolsv.exe 4460 spoolsv.exe 3580 spoolsv.exe 4580 spoolsv.exe 4588 explorer.exe 3100 spoolsv.exe 3860 spoolsv.exe 1596 spoolsv.exe 1228 spoolsv.exe 1120 spoolsv.exe 3300 explorer.exe 3208 spoolsv.exe 4932 spoolsv.exe 5116 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 51 IoCs
description pid Process procid_target PID 5080 set thread context of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 3228 set thread context of 1876 3228 explorer.exe 95 PID 4720 set thread context of 1212 4720 spoolsv.exe 126 PID 3568 set thread context of 3820 3568 spoolsv.exe 128 PID 4432 set thread context of 2884 4432 spoolsv.exe 129 PID 1508 set thread context of 2488 1508 spoolsv.exe 130 PID 4800 set thread context of 400 4800 spoolsv.exe 131 PID 740 set thread context of 2360 740 spoolsv.exe 133 PID 3132 set thread context of 3492 3132 spoolsv.exe 135 PID 3416 set thread context of 2348 3416 spoolsv.exe 136 PID 3748 set thread context of 4116 3748 spoolsv.exe 137 PID 2536 set thread context of 1280 2536 spoolsv.exe 138 PID 640 set thread context of 4192 640 spoolsv.exe 140 PID 2068 set thread context of 4376 2068 spoolsv.exe 142 PID 2644 set thread context of 2472 2644 spoolsv.exe 143 PID 2940 set thread context of 3520 2940 spoolsv.exe 144 PID 1472 set thread context of 3580 1472 spoolsv.exe 146 PID 1636 set thread context of 4580 1636 spoolsv.exe 147 PID 4316 set thread context of 3100 4316 spoolsv.exe 149 PID 1464 set thread context of 3860 1464 spoolsv.exe 150 PID 4364 set thread context of 1228 4364 spoolsv.exe 152 PID 1252 set thread context of 1120 1252 spoolsv.exe 153 PID 948 set thread context of 3208 948 spoolsv.exe 155 PID 1416 set thread context of 4932 1416 spoolsv.exe 156 PID 2944 set thread context of 5116 2944 spoolsv.exe 157 PID 1412 set thread context of 5076 1412 spoolsv.exe 159 PID 904 set thread context of 3176 904 spoolsv.exe 161 PID 2932 set thread context of 3248 2932 spoolsv.exe 162 PID 4320 set thread context of 4952 4320 spoolsv.exe 163 PID 2452 set thread context of 632 2452 spoolsv.exe 165 PID 4592 set thread context of 2304 4592 spoolsv.exe 166 PID 5040 set thread context of 1928 5040 spoolsv.exe 170 PID 1108 set thread context of 528 1108 explorer.exe 173 PID 2120 set thread context of 1380 2120 spoolsv.exe 177 PID 3428 set thread context of 4604 3428 explorer.exe 179 PID 4812 set thread context of 3708 4812 spoolsv.exe 183 PID 2252 set thread context of 4012 2252 explorer.exe 185 PID 4460 set thread context of 2920 4460 spoolsv.exe 189 PID 4588 set thread context of 4660 4588 explorer.exe 191 PID 1596 set thread context of 2412 1596 spoolsv.exe 195 PID 3300 set thread context of 1028 3300 explorer.exe 197 PID 5032 set thread context of 688 5032 spoolsv.exe 201 PID 3256 set thread context of 3240 3256 explorer.exe 204 PID 396 set thread context of 2108 396 spoolsv.exe 206 PID 2228 set thread context of 1984 2228 spoolsv.exe 208 PID 2112 set thread context of 2904 2112 spoolsv.exe 210 PID 1180 set thread context of 2016 1180 spoolsv.exe 213 PID 4984 set thread context of 180 4984 spoolsv.exe 215 PID 4836 set thread context of 4276 4836 explorer.exe 216 PID 1080 set thread context of 3188 1080 spoolsv.exe 217 PID 2060 set thread context of 3004 2060 spoolsv.exe 218 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1876 explorer.exe 1212 spoolsv.exe 1212 spoolsv.exe 3820 spoolsv.exe 3820 spoolsv.exe 2884 spoolsv.exe 2884 spoolsv.exe 2488 spoolsv.exe 2488 spoolsv.exe 400 spoolsv.exe 400 spoolsv.exe 2360 spoolsv.exe 2360 spoolsv.exe 3492 spoolsv.exe 3492 spoolsv.exe 2348 spoolsv.exe 2348 spoolsv.exe 4116 spoolsv.exe 4116 spoolsv.exe 1280 spoolsv.exe 1280 spoolsv.exe 4192 spoolsv.exe 4192 spoolsv.exe 4376 spoolsv.exe 4376 spoolsv.exe 2472 spoolsv.exe 2472 spoolsv.exe 3520 spoolsv.exe 3520 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 4580 spoolsv.exe 4580 spoolsv.exe 3100 spoolsv.exe 3100 spoolsv.exe 3860 spoolsv.exe 3860 spoolsv.exe 1228 spoolsv.exe 1228 spoolsv.exe 1120 spoolsv.exe 1120 spoolsv.exe 3208 spoolsv.exe 3208 spoolsv.exe 4932 spoolsv.exe 4932 spoolsv.exe 5116 spoolsv.exe 5116 spoolsv.exe 5076 spoolsv.exe 5076 spoolsv.exe 3176 spoolsv.exe 3176 spoolsv.exe 3248 spoolsv.exe 3248 spoolsv.exe 4952 spoolsv.exe 4952 spoolsv.exe 632 spoolsv.exe 632 spoolsv.exe 2304 spoolsv.exe 2304 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 2468 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 82 PID 5080 wrote to memory of 2468 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 82 PID 5080 wrote to memory of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 5080 wrote to memory of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 5080 wrote to memory of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 5080 wrote to memory of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 5080 wrote to memory of 548 5080 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 91 PID 548 wrote to memory of 3228 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 92 PID 548 wrote to memory of 3228 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 92 PID 548 wrote to memory of 3228 548 fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe 92 PID 3228 wrote to memory of 1876 3228 explorer.exe 95 PID 3228 wrote to memory of 1876 3228 explorer.exe 95 PID 3228 wrote to memory of 1876 3228 explorer.exe 95 PID 3228 wrote to memory of 1876 3228 explorer.exe 95 PID 3228 wrote to memory of 1876 3228 explorer.exe 95 PID 1876 wrote to memory of 4720 1876 explorer.exe 96 PID 1876 wrote to memory of 4720 1876 explorer.exe 96 PID 1876 wrote to memory of 4720 1876 explorer.exe 96 PID 1876 wrote to memory of 3568 1876 explorer.exe 97 PID 1876 wrote to memory of 3568 1876 explorer.exe 97 PID 1876 wrote to memory of 3568 1876 explorer.exe 97 PID 1876 wrote to memory of 4432 1876 explorer.exe 98 PID 1876 wrote to memory of 4432 1876 explorer.exe 98 PID 1876 wrote to memory of 4432 1876 explorer.exe 98 PID 1876 wrote to memory of 1508 1876 explorer.exe 99 PID 1876 wrote to memory of 1508 1876 explorer.exe 99 PID 1876 wrote to memory of 1508 1876 explorer.exe 99 PID 1876 wrote to memory of 4800 1876 explorer.exe 100 PID 1876 wrote to memory of 4800 1876 explorer.exe 100 PID 1876 wrote to memory of 4800 1876 explorer.exe 100 PID 1876 wrote to memory of 740 1876 explorer.exe 101 PID 1876 wrote to memory of 740 1876 explorer.exe 101 PID 1876 wrote to memory of 740 1876 explorer.exe 101 PID 1876 wrote to memory of 3132 1876 explorer.exe 102 PID 1876 wrote to memory of 3132 1876 explorer.exe 102 PID 1876 wrote to memory of 3132 1876 explorer.exe 102 PID 1876 wrote to memory of 3416 1876 explorer.exe 103 PID 1876 wrote to memory of 3416 1876 explorer.exe 103 PID 1876 wrote to memory of 3416 1876 explorer.exe 103 PID 1876 wrote to memory of 3748 1876 explorer.exe 104 PID 1876 wrote to memory of 3748 1876 explorer.exe 104 PID 1876 wrote to memory of 3748 1876 explorer.exe 104 PID 1876 wrote to memory of 2536 1876 explorer.exe 105 PID 1876 wrote to memory of 2536 1876 explorer.exe 105 PID 1876 wrote to memory of 2536 1876 explorer.exe 105 PID 1876 wrote to memory of 640 1876 explorer.exe 106 PID 1876 wrote to memory of 640 1876 explorer.exe 106 PID 1876 wrote to memory of 640 1876 explorer.exe 106 PID 1876 wrote to memory of 2068 1876 explorer.exe 107 PID 1876 wrote to memory of 2068 1876 explorer.exe 107 PID 1876 wrote to memory of 2068 1876 explorer.exe 107 PID 1876 wrote to memory of 2644 1876 explorer.exe 108 PID 1876 wrote to memory of 2644 1876 explorer.exe 108 PID 1876 wrote to memory of 2644 1876 explorer.exe 108 PID 1876 wrote to memory of 2940 1876 explorer.exe 109 PID 1876 wrote to memory of 2940 1876 explorer.exe 109 PID 1876 wrote to memory of 2940 1876 explorer.exe 109 PID 1876 wrote to memory of 1472 1876 explorer.exe 110 PID 1876 wrote to memory of 1472 1876 explorer.exe 110 PID 1876 wrote to memory of 1472 1876 explorer.exe 110 PID 1876 wrote to memory of 1636 1876 explorer.exe 111 PID 1876 wrote to memory of 1636 1876 explorer.exe 111 PID 1876 wrote to memory of 1636 1876 explorer.exe 111 PID 1876 wrote to memory of 4316 1876 explorer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd9d3865941e3b86cc01caecdfb2ce7b_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1212 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:528
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:400
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4604
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3492
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2348
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:640 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2252 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4012
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3580
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4580 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4588 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4660
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4316 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3300 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1028
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:948 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3208
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2944 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5076 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3256 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3240
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3248
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4320 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4952
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2452 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:632
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4592 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4836 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4276
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1380
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1196
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3708 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:668
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3740
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:688 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:448
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2520
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2112 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2904
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2016
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4984 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:180
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:596
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3724
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2616
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4148
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1756
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:64
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:60
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:388
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1704
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4524
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD589c92ff856d16b7a01286e9dd34cf9d9
SHA1bc55da2ac0a92f50c752b07f1f6c8fa775208cdf
SHA25620c4129cdb0774970eaa5a95d2ed54438d7a7a3d7fda10404a7eeaa350e627c5
SHA5129de251baa9d0072898b8b75e6ee6af7de1b41fba361d95ccbba5a26ffe9e09d99497e9e6c35bed01fc5911dc5d08661060fb3bfad3cabd2be3e903ddffb98c32
-
Filesize
2.2MB
MD5b0f530887038fee950ae374abf44f1d2
SHA16a2b8c17039a214bbb88aefe05fd6abf31946722
SHA256c5fd9f917f5431580b287859b3a0fa51dca69c828af0f4c90c594d28f6ad5fd9
SHA512be62a0b99344b948d4b0a34dccf9e2e8ac2921826cfcdbaab3f27c765b7e2810f8f13281faf0efb64bd880c433cff03cbf18382227ac932025b0272b15dadcb8