Analysis
- max time kernel
41s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/01/2025, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe
- Size 85KB
- Sample250127-ye2gbstmdm
- SHA256 38929d98822063ef15ea05aef14eefe65bb982927721ff4bd5802523a73f1670
- MD5 430ed5d816c63e0f4f016a295416abad
- SHA1 f848726933542fec77f942f6b51d23386b2f420f
- SHA512 382b2be984a10a7c7aebabf0b9bcd6b3270850f2013b8a2bf907d34a3fbb01c32366a3cb34fef8214af10cb2456d1520f3ae4fe2db9fcbe52cfcbba68a39b184
- SSDEEP 1536:d/lzBrR4uibG9lex2fXoi2RRINMeFwG/cY+8IXV+7Aal0s:PB+7MXaZ96cfXc7Aal0s
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2152 win_spool2.exe 1624 win_spool2.exe 4548 win_spool2.exe 3748 win_spool2.exe 884 win_spool2.exe 4836 win_spool2.exe 1048 win_spool2.exe 3944 win_spool2.exe 4828 win_spool2.exe 2012 win_spool2.exe 4344 win_spool2.exe 4568 win_spool2.exe 672 win_spool2.exe 860 win_spool2.exe 4624 win_spool2.exe 1812 win_spool2.exe 2596 win_spool2.exe 1708 win_spool2.exe 3192 win_spool2.exe 4992 win_spool2.exe 4860 win_spool2.exe 2476 win_spool2.exe 760 win_spool2.exe 2988 win_spool2.exe 2736 win_spool2.exe 3380 win_spool2.exe 1304 win_spool2.exe 4848 win_spool2.exe 4020 win_spool2.exe 220 win_spool2.exe 4012 win_spool2.exe 4428 win_spool2.exe 3280 win_spool2.exe 3236 win_spool2.exe 1612 win_spool2.exe 4952 win_spool2.exe 4312 win_spool2.exe 980 win_spool2.exe 2968 win_spool2.exe 1228 win_spool2.exe 4556 win_spool2.exe 4656 win_spool2.exe 3776 win_spool2.exe 4692 win_spool2.exe 1732 win_spool2.exe 2416 win_spool2.exe 3716 win_spool2.exe 4672 win_spool2.exe 1992 win_spool2.exe 3932 win_spool2.exe 4212 win_spool2.exe 2328 win_spool2.exe 4892 win_spool2.exe 1532 win_spool2.exe 3668 win_spool2.exe 3536 win_spool2.exe 636 win_spool2.exe 1760 win_spool2.exe 4596 win_spool2.exe 3476 win_spool2.exe 1556 win_spool2.exe 524 win_spool2.exe 1644 win_spool2.exe 2004 win_spool2.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win_spool2 = "C:\\Windows\\system32\\win_spool2.exe" win_spool2.exe - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logon = "WLELogon" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Startup = "WLEStartup" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StopScreenSaver = "WLEStopScreenSaver" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Startup = "WLEStartup" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logoff = "WLELogoff" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logoff = "WLELogoff" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Asynchronous = "0" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Lock = "WLELock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Lock = "WLELock" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Lock = "WLELock" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" win_spool2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logoff = "WLELogoff" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" win_spool2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Startup = "WLEStartup" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Startup = "WLEStartup" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" win_spool2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Startup = "WLEStartup" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logon = "WLELogon" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StopScreenSaver = "WLEStopScreenSaver" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Asynchronous = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" win_spool2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Asynchronous = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logon = "WLELogon" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Unlock = "WLEUnlock" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Logon = "WLELogon" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\DllName = "win_spool2.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2 win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\StartScreenSaver = "WLEStartScreenSaver" win_spool2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Shutdown = "WLEShutdown" win_spool2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\win_spool2\Impersonate = "0" win_spool2.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe win_spool2.exe File created C:\Windows\SysWOW64\win_spool2.exe Process not Found File created C:\Windows\SysWOW64\win_spool2.exe Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win_spool2.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2152 4376 JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe 82 PID 4376 wrote to memory of 2152 4376 JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe 82 PID 4376 wrote to memory of 2152 4376 JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe 82 PID 2152 wrote to memory of 1624 2152 win_spool2.exe 83 PID 2152 wrote to memory of 1624 2152 win_spool2.exe 83 PID 2152 wrote to memory of 1624 2152 win_spool2.exe 83 PID 1624 wrote to memory of 4548 1624 win_spool2.exe 84 PID 1624 wrote to memory of 4548 1624 win_spool2.exe 84 PID 1624 wrote to memory of 4548 1624 win_spool2.exe 84 PID 4548 wrote to memory of 3748 4548 win_spool2.exe 85 PID 4548 wrote to memory of 3748 4548 win_spool2.exe 85 PID 4548 wrote to memory of 3748 4548 win_spool2.exe 85 PID 3748 wrote to memory of 884 3748 win_spool2.exe 86 PID 3748 wrote to memory of 884 3748 win_spool2.exe 86 PID 3748 wrote to memory of 884 3748 win_spool2.exe 86 PID 884 wrote to memory of 4836 884 win_spool2.exe 87 PID 884 wrote to memory of 4836 884 win_spool2.exe 87 PID 884 wrote to memory of 4836 884 win_spool2.exe 87 PID 4836 wrote to memory of 1048 4836 win_spool2.exe 88 PID 4836 wrote to memory of 1048 4836 win_spool2.exe 88 PID 4836 wrote to memory of 1048 4836 win_spool2.exe 88 PID 1048 wrote to memory of 3944 1048 win_spool2.exe 89 PID 1048 wrote to memory of 3944 1048 win_spool2.exe 89 PID 1048 wrote to memory of 3944 1048 win_spool2.exe 89 PID 3944 wrote to memory of 4828 3944 win_spool2.exe 90 PID 3944 wrote to memory of 4828 3944 win_spool2.exe 90 PID 3944 wrote to memory of 4828 3944 win_spool2.exe 90 PID 4828 wrote to memory of 2012 4828 win_spool2.exe 91 PID 4828 wrote to memory of 2012 4828 win_spool2.exe 91 PID 4828 wrote to memory of 2012 4828 win_spool2.exe 91 PID 2012 wrote to memory of 4344 2012 win_spool2.exe 92 PID 2012 wrote to memory of 4344 2012 win_spool2.exe 92 PID 2012 wrote to memory of 4344 2012 win_spool2.exe 92 PID 4344 wrote to memory of 4568 4344 win_spool2.exe 93 PID 4344 wrote to memory of 4568 4344 win_spool2.exe 93 PID 4344 wrote to memory of 4568 4344 win_spool2.exe 93 PID 4568 wrote to memory of 672 4568 win_spool2.exe 94 PID 4568 wrote to memory of 672 4568 win_spool2.exe 94 PID 4568 wrote to memory of 672 4568 win_spool2.exe 94 PID 672 wrote to memory of 860 672 win_spool2.exe 95 PID 672 wrote to memory of 860 672 win_spool2.exe 95 PID 672 wrote to memory of 860 672 win_spool2.exe 95 PID 860 wrote to memory of 4624 860 win_spool2.exe 96 PID 860 wrote to memory of 4624 860 win_spool2.exe 96 PID 860 wrote to memory of 4624 860 win_spool2.exe 96 PID 4624 wrote to memory of 1812 4624 win_spool2.exe 97 PID 4624 wrote to memory of 1812 4624 win_spool2.exe 97 PID 4624 wrote to memory of 1812 4624 win_spool2.exe 97 PID 1812 wrote to memory of 2596 1812 win_spool2.exe 98 PID 1812 wrote to memory of 2596 1812 win_spool2.exe 98 PID 1812 wrote to memory of 2596 1812 win_spool2.exe 98 PID 2596 wrote to memory of 1708 2596 win_spool2.exe 99 PID 2596 wrote to memory of 1708 2596 win_spool2.exe 99 PID 2596 wrote to memory of 1708 2596 win_spool2.exe 99 PID 1708 wrote to memory of 3192 1708 win_spool2.exe 100 PID 1708 wrote to memory of 3192 1708 win_spool2.exe 100 PID 1708 wrote to memory of 3192 1708 win_spool2.exe 100 PID 3192 wrote to memory of 4992 3192 win_spool2.exe 101 PID 3192 wrote to memory of 4992 3192 win_spool2.exe 101 PID 3192 wrote to memory of 4992 3192 win_spool2.exe 101 PID 4992 wrote to memory of 4860 4992 win_spool2.exe 102 PID 4992 wrote to memory of 4860 4992 win_spool2.exe 102 PID 4992 wrote to memory of 4860 4992 win_spool2.exe 102 PID 4860 wrote to memory of 2476 4860 win_spool2.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_430ed5d816c63e0f4f016a295416abad.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe19⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe23⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe24⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe25⤵
- Executes dropped EXE
PID:2988 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe27⤵
- Executes dropped EXE
PID:3380 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe28⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe29⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe30⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4020 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe31⤵
- Executes dropped EXE
PID:220 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe32⤵
- Executes dropped EXE
PID:4012 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe33⤵
- Executes dropped EXE
PID:4428 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe34⤵
- Executes dropped EXE
PID:3280 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe35⤵
- Executes dropped EXE
PID:3236 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe36⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe38⤵
- Executes dropped EXE
PID:4312 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe40⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe41⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe42⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe43⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4656 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe44⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe45⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe46⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe47⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe48⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe49⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe50⤵
- Executes dropped EXE
PID:1992 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe51⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe52⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe53⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe54⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe55⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe56⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe57⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe58⤵
- Executes dropped EXE
PID:636 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe59⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe60⤵
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe61⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe62⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe63⤵
- Executes dropped EXE
PID:524 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe64⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe65⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe66⤵PID:3620
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe67⤵PID:1804
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe68⤵PID:2660
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe69⤵PID:3136
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe70⤵PID:3644
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe71⤵
- Adds Run key to start application
PID:2368 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe72⤵PID:1396
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe73⤵PID:2588
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe74⤵PID:4576
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe75⤵PID:2432
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe76⤵PID:3416
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe77⤵PID:3120
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe78⤵PID:2716
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe79⤵PID:2696
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe80⤵PID:2672
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe81⤵PID:4972
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe82⤵PID:4016
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe83⤵PID:1728
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe84⤵
- Adds Run key to start application
PID:3988 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe85⤵PID:1832
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe86⤵
- Modifies WinLogon
PID:3312 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe87⤵PID:1124
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe88⤵PID:2064
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe89⤵PID:2720
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe90⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4528 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe91⤵PID:3728
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe92⤵PID:4436
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe93⤵PID:2444
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe94⤵PID:2288
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe95⤵
- Modifies WinLogon
PID:4856 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe96⤵
- Adds Run key to start application
PID:4840 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe97⤵PID:3724
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe98⤵
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe99⤵PID:1976
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe100⤵PID:4928
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe101⤵PID:4700
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe102⤵PID:3204
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe103⤵PID:4340
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe104⤵PID:208
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe105⤵PID:2272
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe106⤵PID:1416
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe107⤵PID:3252
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe108⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe109⤵PID:3104
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe110⤵
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe111⤵PID:1040
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe112⤵PID:5132
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe113⤵PID:5148
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe114⤵PID:5160
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe115⤵PID:5180
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe116⤵PID:5192
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe117⤵PID:5212
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe118⤵PID:5224
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe119⤵PID:5248
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe120⤵PID:5260
-
C:\Windows\SysWOW64\win_spool2.exeC:\Windows\system32\win_spool2.exe121⤵PID:5276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-