Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 07:16
Behavioral task
behavioral1
Sample
JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe
-
Size
2.2MB
-
MD5
06ee4c61292ff9ebf335e21d6ec37f93
-
SHA1
4927e5f6f3397d75e1b43f3c967b03691822257a
-
SHA256
ffa45dcb8a414c1a8e48464f3cffe968ff1d50afc5f256024f9d7ebb161cc403
-
SHA512
b173f38a17da385f8d672b3c27e9f2cc174f21c5ff4e72c45adc555dd65d5cc108ce2639c1e14b3dc3c79dd8fa735194402198e2beed4a4d80f81ba73c7a03d9
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWwwG
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Detects Mofksys worm 64 IoCs
resource yara_rule behavioral1/memory/436-38-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/436-39-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/436-77-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5856-88-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5856-672-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1344-1930-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5664-1939-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5012-1954-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5728-1962-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1264-1975-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5296-1982-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5296-1985-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1344-2093-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3304-2111-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4352-2121-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2340-2131-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5548-2226-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3304-2286-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5492-2304-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3108-2313-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4072-2323-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4464-2332-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3488-2341-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2256-2434-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3996-2442-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5492-2507-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5620-2526-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3444-2572-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/736-2639-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5224-2646-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5620-2677-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5696-2705-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4896-2712-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4896-2716-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5388-2801-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5388-2805-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/548-2894-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1380-2985-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/548-3028-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6060-3225-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2964-3236-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6060-3353-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1748-3413-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4864-3425-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1748-3537-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5856-3600-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2148-3771-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4752-3912-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2148-3939-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1184-4239-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3556-4260-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3192-4493-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3588-4516-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/512-4524-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5720-4601-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/432-4609-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/512-4662-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2304-4748-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2304-4891-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/64-4976-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4784-4987-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/1708-5012-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3464-5071-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2728-5147-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Mofksys family
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe -
Executes dropped EXE 64 IoCs
pid Process 452 explorer.exe 5856 explorer.exe 4628 spoolsv.exe 4684 spoolsv.exe 2144 explorer.exe 3728 spoolsv.exe 3748 spoolsv.exe 5192 spoolsv.exe 724 spoolsv.exe 1136 spoolsv.exe 3336 spoolsv.exe 1432 spoolsv.exe 3228 spoolsv.exe 1632 spoolsv.exe 6068 spoolsv.exe 4288 spoolsv.exe 5460 spoolsv.exe 4272 spoolsv.exe 4412 spoolsv.exe 6064 spoolsv.exe 5400 spoolsv.exe 1388 spoolsv.exe 5380 spoolsv.exe 5612 spoolsv.exe 4040 spoolsv.exe 4976 spoolsv.exe 3060 spoolsv.exe 1624 spoolsv.exe 2996 spoolsv.exe 3604 spoolsv.exe 5200 spoolsv.exe 2236 spoolsv.exe 1344 spoolsv.exe 5496 explorer.exe 5664 spoolsv.exe 5012 explorer.exe 5728 spoolsv.exe 1264 spoolsv.exe 5296 spoolsv.exe 4116 spoolsv.exe 3304 spoolsv.exe 4776 explorer.exe 4352 spoolsv.exe 2340 spoolsv.exe 1548 spoolsv.exe 2740 spoolsv.exe 5548 spoolsv.exe 5492 spoolsv.exe 4340 explorer.exe 3108 spoolsv.exe 4072 spoolsv.exe 4464 spoolsv.exe 3488 spoolsv.exe 3644 spoolsv.exe 2256 spoolsv.exe 3996 spoolsv.exe 5620 spoolsv.exe 1576 explorer.exe 1956 spoolsv.exe 3444 spoolsv.exe 5176 spoolsv.exe 736 spoolsv.exe 5224 spoolsv.exe 5696 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 52 IoCs
description pid Process procid_target PID 3268 set thread context of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 452 set thread context of 5856 452 explorer.exe 114 PID 4628 set thread context of 1344 4628 spoolsv.exe 150 PID 4684 set thread context of 5664 4684 spoolsv.exe 152 PID 2144 set thread context of 5012 2144 explorer.exe 153 PID 3728 set thread context of 5728 3728 spoolsv.exe 154 PID 3748 set thread context of 1264 3748 spoolsv.exe 155 PID 5192 set thread context of 5296 5192 spoolsv.exe 156 PID 724 set thread context of 3304 724 spoolsv.exe 158 PID 1136 set thread context of 4352 1136 spoolsv.exe 160 PID 3336 set thread context of 2340 3336 spoolsv.exe 161 PID 1432 set thread context of 1548 1432 spoolsv.exe 162 PID 3228 set thread context of 5548 3228 spoolsv.exe 164 PID 1632 set thread context of 5492 1632 spoolsv.exe 165 PID 6068 set thread context of 3108 6068 spoolsv.exe 167 PID 4288 set thread context of 4072 4288 spoolsv.exe 168 PID 5460 set thread context of 4464 5460 spoolsv.exe 169 PID 4272 set thread context of 3488 4272 spoolsv.exe 170 PID 4412 set thread context of 2256 4412 spoolsv.exe 172 PID 6064 set thread context of 3996 6064 spoolsv.exe 173 PID 5400 set thread context of 5620 5400 spoolsv.exe 174 PID 1388 set thread context of 1956 1388 spoolsv.exe 176 PID 5380 set thread context of 3444 5380 spoolsv.exe 177 PID 5612 set thread context of 736 5612 spoolsv.exe 179 PID 4040 set thread context of 5224 4040 spoolsv.exe 180 PID 4976 set thread context of 5696 4976 spoolsv.exe 181 PID 3060 set thread context of 4896 3060 spoolsv.exe 183 PID 1624 set thread context of 5840 1624 spoolsv.exe 185 PID 2996 set thread context of 5388 2996 spoolsv.exe 186 PID 3604 set thread context of 548 3604 spoolsv.exe 187 PID 5200 set thread context of 1380 5200 spoolsv.exe 190 PID 2236 set thread context of 6060 2236 spoolsv.exe 194 PID 5496 set thread context of 2964 5496 explorer.exe 196 PID 4116 set thread context of 1748 4116 spoolsv.exe 199 PID 4776 set thread context of 4864 4776 explorer.exe 201 PID 2740 set thread context of 2148 2740 spoolsv.exe 206 PID 4340 set thread context of 4752 4340 explorer.exe 209 PID 3644 set thread context of 1184 3644 spoolsv.exe 212 PID 1576 set thread context of 3556 1576 explorer.exe 216 PID 5176 set thread context of 3192 5176 spoolsv.exe 219 PID 4760 set thread context of 3588 4760 explorer.exe 222 PID 5248 set thread context of 512 5248 spoolsv.exe 223 PID 4356 set thread context of 5720 4356 explorer.exe 226 PID 3164 set thread context of 432 3164 spoolsv.exe 227 PID 4920 set thread context of 2304 4920 spoolsv.exe 229 PID 4420 set thread context of 5108 4420 spoolsv.exe 232 PID 4000 set thread context of 64 4000 spoolsv.exe 234 PID 2276 set thread context of 4784 2276 explorer.exe 236 PID 2956 set thread context of 1708 2956 spoolsv.exe 237 PID 5912 set thread context of 3464 5912 spoolsv.exe 239 PID 5088 set thread context of 2728 5088 explorer.exe 241 PID 1124 set thread context of 5404 1124 spoolsv.exe 243 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5856 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 5856 explorer.exe 1344 spoolsv.exe 1344 spoolsv.exe 5664 spoolsv.exe 5664 spoolsv.exe 5012 explorer.exe 5012 explorer.exe 5728 spoolsv.exe 5728 spoolsv.exe 1264 spoolsv.exe 1264 spoolsv.exe 5296 spoolsv.exe 5296 spoolsv.exe 3304 spoolsv.exe 3304 spoolsv.exe 4352 spoolsv.exe 4352 spoolsv.exe 2340 spoolsv.exe 2340 spoolsv.exe 1548 spoolsv.exe 1548 spoolsv.exe 5548 spoolsv.exe 5548 spoolsv.exe 5492 spoolsv.exe 5492 spoolsv.exe 3108 spoolsv.exe 3108 spoolsv.exe 4072 spoolsv.exe 4072 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe 2256 spoolsv.exe 2256 spoolsv.exe 3996 spoolsv.exe 3996 spoolsv.exe 5620 spoolsv.exe 5620 spoolsv.exe 1956 spoolsv.exe 1956 spoolsv.exe 3444 spoolsv.exe 3444 spoolsv.exe 736 spoolsv.exe 736 spoolsv.exe 5224 spoolsv.exe 5224 spoolsv.exe 5696 spoolsv.exe 5696 spoolsv.exe 4896 spoolsv.exe 4896 spoolsv.exe 5840 spoolsv.exe 5840 spoolsv.exe 5388 spoolsv.exe 5388 spoolsv.exe 548 spoolsv.exe 548 spoolsv.exe 1380 spoolsv.exe 1380 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 2416 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 86 PID 3268 wrote to memory of 2416 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 86 PID 3268 wrote to memory of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 3268 wrote to memory of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 3268 wrote to memory of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 3268 wrote to memory of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 3268 wrote to memory of 436 3268 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 103 PID 436 wrote to memory of 452 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 104 PID 436 wrote to memory of 452 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 104 PID 436 wrote to memory of 452 436 JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe 104 PID 452 wrote to memory of 5856 452 explorer.exe 114 PID 452 wrote to memory of 5856 452 explorer.exe 114 PID 452 wrote to memory of 5856 452 explorer.exe 114 PID 452 wrote to memory of 5856 452 explorer.exe 114 PID 452 wrote to memory of 5856 452 explorer.exe 114 PID 5856 wrote to memory of 4628 5856 explorer.exe 115 PID 5856 wrote to memory of 4628 5856 explorer.exe 115 PID 5856 wrote to memory of 4628 5856 explorer.exe 115 PID 5856 wrote to memory of 4684 5856 explorer.exe 120 PID 5856 wrote to memory of 4684 5856 explorer.exe 120 PID 5856 wrote to memory of 4684 5856 explorer.exe 120 PID 3592 wrote to memory of 2144 3592 cmd.exe 121 PID 3592 wrote to memory of 2144 3592 cmd.exe 121 PID 3592 wrote to memory of 2144 3592 cmd.exe 121 PID 5856 wrote to memory of 3728 5856 explorer.exe 122 PID 5856 wrote to memory of 3728 5856 explorer.exe 122 PID 5856 wrote to memory of 3728 5856 explorer.exe 122 PID 5856 wrote to memory of 3748 5856 explorer.exe 123 PID 5856 wrote to memory of 3748 5856 explorer.exe 123 PID 5856 wrote to memory of 3748 5856 explorer.exe 123 PID 5856 wrote to memory of 5192 5856 explorer.exe 124 PID 5856 wrote to memory of 5192 5856 explorer.exe 124 PID 5856 wrote to memory of 5192 5856 explorer.exe 124 PID 5856 wrote to memory of 724 5856 explorer.exe 125 PID 5856 wrote to memory of 724 5856 explorer.exe 125 PID 5856 wrote to memory of 724 5856 explorer.exe 125 PID 5856 wrote to memory of 1136 5856 explorer.exe 126 PID 5856 wrote to memory of 1136 5856 explorer.exe 126 PID 5856 wrote to memory of 1136 5856 explorer.exe 126 PID 5856 wrote to memory of 3336 5856 explorer.exe 127 PID 5856 wrote to memory of 3336 5856 explorer.exe 127 PID 5856 wrote to memory of 3336 5856 explorer.exe 127 PID 5856 wrote to memory of 1432 5856 explorer.exe 128 PID 5856 wrote to memory of 1432 5856 explorer.exe 128 PID 5856 wrote to memory of 1432 5856 explorer.exe 128 PID 5856 wrote to memory of 3228 5856 explorer.exe 129 PID 5856 wrote to memory of 3228 5856 explorer.exe 129 PID 5856 wrote to memory of 3228 5856 explorer.exe 129 PID 5856 wrote to memory of 1632 5856 explorer.exe 130 PID 5856 wrote to memory of 1632 5856 explorer.exe 130 PID 5856 wrote to memory of 1632 5856 explorer.exe 130 PID 5856 wrote to memory of 6068 5856 explorer.exe 131 PID 5856 wrote to memory of 6068 5856 explorer.exe 131 PID 5856 wrote to memory of 6068 5856 explorer.exe 131 PID 5856 wrote to memory of 4288 5856 explorer.exe 132 PID 5856 wrote to memory of 4288 5856 explorer.exe 132 PID 5856 wrote to memory of 4288 5856 explorer.exe 132 PID 5856 wrote to memory of 5460 5856 explorer.exe 134 PID 5856 wrote to memory of 5460 5856 explorer.exe 134 PID 5856 wrote to memory of 5460 5856 explorer.exe 134 PID 5856 wrote to memory of 4272 5856 explorer.exe 135 PID 5856 wrote to memory of 4272 5856 explorer.exe 135 PID 5856 wrote to memory of 4272 5856 explorer.exe 135 PID 5856 wrote to memory of 4412 5856 explorer.exe 136
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06ee4c61292ff9ebf335e21d6ec37f93.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5496 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2964
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5664
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3728 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1264
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5192 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5296
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3304 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4776 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4864
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1136 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1432 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3228 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1632 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5492 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4340 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4752
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5460 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4464
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3488
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3996
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5620 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3556
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5380 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:736
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5224
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5696 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4760 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:3588
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5840
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5388
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3604 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:548 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5720
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2236 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:6060 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4784
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4116 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5088 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2728
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- System Location Discovery: System Language Discovery
PID:4432
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3644 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1184
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3772
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3192 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1596
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:512 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6128
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3164 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:432
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3844
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5108
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:64
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5780
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2956 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5912 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3464
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3132
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2544
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2656
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4992
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4216
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:5164
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4968
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO1⤵PID:2280
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe RO2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2144 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5012
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD52cafa0e028759b73e73a0246d0b0b822
SHA191ab62184b33864d795ede17e33fc15830f200f7
SHA2565bbfb37f8a79e5afc5c68ed5a5b5e853b8bb09a4eec6d05912775b635eda0582
SHA5129bfcf9ad8fe478ddcb10531fd5fdaf7e86ca456e32a562e3b669f82358bea53077c2770e8d94aabd64262d19ee9d6ba88b8bcd6c4f0ff851787fe56bb22e7bd7
-
Filesize
2.2MB
MD5bd91686c824229ab96187732dc56139d
SHA19814c26e33b1cbb89ece10e7ccb37d4b5bfe47c1
SHA256e5be6c54f8ba358e4721f6e86007cbd60d1c7ef17d42f5d6b8d4d103b25839d7
SHA51296e61f31c18d27a7823e746d3e7e481f97a68e6be53ac169bab36a2968a4a77450b7bc4288b0b1d50f6b95ae71fdcb5e2d6724ca5f3dffc216bf844dcada9add