Analysis
-
max time kernel
148s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2025, 01:14
Behavioral task
behavioral1
Sample
JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe
-
Size
2.2MB
-
MD5
072b03cd5fbc369fd68bcf35be14a173
-
SHA1
bca6022f6082084b90e75f60e9861fe8e4dc38ef
-
SHA256
2c1d110b0c75dd1a347f967a608ccad7d681ce46968fe7fef762207e053acad2
-
SHA512
d82b21d67f7724831189b993ea51b4cee4c77f495287123cf4ac2db3065b811c5cde054b62d20b254b4a6ff11561500b9805bdaa8c7c98081386664dd1e5eee6
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwD
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Detects Mofksys worm 64 IoCs
resource yara_rule behavioral1/memory/4508-34-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4508-35-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4508-79-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3004-89-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3004-671-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4964-1985-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5184-2081-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5244-2090-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5364-2097-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5364-2101-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5424-2109-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5424-2112-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5484-2121-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5556-2131-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4964-2236-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6096-2255-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3592-2267-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3328-2278-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3328-2274-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5176-2287-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6096-2416-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5588-2433-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5724-2442-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5784-2456-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5884-2465-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5960-2474-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6004-2485-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/6004-2482-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5588-2592-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5208-2609-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5384-2618-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5384-2623-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5428-2633-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5208-2774-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3496-2802-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3712-2893-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5680-2899-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5680-2902-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3784-2959-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5472-2967-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5728-3038-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/216-3252-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5788-3400-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5836-3410-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5788-3498-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5448-3638-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/244-3649-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3004-3866-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3344-3936-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4352-3948-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5248-4141-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5400-4152-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5248-4289-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4108-4494-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2992-4515-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4796-4569-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2424-4581-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4796-4712-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3696-4797-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5688-4808-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/4828-4814-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/2152-4886-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/3368-5011-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral1/memory/5992-5021-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Mofksys family
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe -
Executes dropped EXE 64 IoCs
pid Process 3104 explorer.exe 3004 explorer.exe 376 spoolsv.exe 5080 spoolsv.exe 3128 explorer.exe 4472 spoolsv.exe 1800 spoolsv.exe 3648 spoolsv.exe 2856 spoolsv.exe 3852 spoolsv.exe 3528 spoolsv.exe 1620 spoolsv.exe 4556 spoolsv.exe 3568 spoolsv.exe 1124 spoolsv.exe 4288 spoolsv.exe 3972 spoolsv.exe 2364 spoolsv.exe 4160 spoolsv.exe 2936 spoolsv.exe 2400 spoolsv.exe 4832 spoolsv.exe 3168 spoolsv.exe 2720 spoolsv.exe 2668 spoolsv.exe 3436 spoolsv.exe 1252 spoolsv.exe 3336 spoolsv.exe 2476 spoolsv.exe 3008 spoolsv.exe 4900 spoolsv.exe 1368 spoolsv.exe 4964 spoolsv.exe 512 explorer.exe 5128 spoolsv.exe 5184 spoolsv.exe 5244 explorer.exe 5364 spoolsv.exe 5424 spoolsv.exe 5484 spoolsv.exe 5556 spoolsv.exe 5792 spoolsv.exe 6096 spoolsv.exe 6140 explorer.exe 3592 spoolsv.exe 3328 spoolsv.exe 5176 spoolsv.exe 5420 spoolsv.exe 5588 spoolsv.exe 5648 explorer.exe 5724 spoolsv.exe 5784 spoolsv.exe 5884 spoolsv.exe 5960 spoolsv.exe 6004 spoolsv.exe 1356 spoolsv.exe 560 spoolsv.exe 5208 spoolsv.exe 1188 explorer.exe 5384 spoolsv.exe 5428 spoolsv.exe 2860 spoolsv.exe 3200 spoolsv.exe 5904 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
description pid Process procid_target PID 2348 set thread context of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 3104 set thread context of 3004 3104 explorer.exe 111 PID 376 set thread context of 4964 376 spoolsv.exe 147 PID 5080 set thread context of 5184 5080 spoolsv.exe 150 PID 3128 set thread context of 5244 3128 explorer.exe 151 PID 4472 set thread context of 5364 4472 spoolsv.exe 152 PID 1800 set thread context of 5424 1800 spoolsv.exe 153 PID 3648 set thread context of 5484 3648 spoolsv.exe 154 PID 2856 set thread context of 5556 2856 spoolsv.exe 155 PID 3852 set thread context of 6096 3852 spoolsv.exe 157 PID 3528 set thread context of 3592 3528 spoolsv.exe 159 PID 1620 set thread context of 3328 1620 spoolsv.exe 160 PID 4556 set thread context of 5176 4556 spoolsv.exe 161 PID 3568 set thread context of 5588 3568 spoolsv.exe 163 PID 1124 set thread context of 5724 1124 spoolsv.exe 165 PID 4288 set thread context of 5784 4288 spoolsv.exe 166 PID 3972 set thread context of 5884 3972 spoolsv.exe 167 PID 2364 set thread context of 5960 2364 spoolsv.exe 168 PID 4160 set thread context of 6004 4160 spoolsv.exe 169 PID 2936 set thread context of 560 2936 spoolsv.exe 171 PID 2400 set thread context of 5208 2400 spoolsv.exe 172 PID 4832 set thread context of 5384 4832 spoolsv.exe 174 PID 3168 set thread context of 5428 3168 spoolsv.exe 175 PID 2720 set thread context of 3200 2720 spoolsv.exe 177 PID 2668 set thread context of 5904 2668 spoolsv.exe 178 PID 3436 set thread context of 3496 3436 spoolsv.exe 180 PID 1252 set thread context of 3712 1252 spoolsv.exe 182 PID 3336 set thread context of 5680 3336 spoolsv.exe 183 PID 2476 set thread context of 3784 2476 spoolsv.exe 184 PID 3008 set thread context of 5472 3008 spoolsv.exe 186 PID 4900 set thread context of 5728 4900 spoolsv.exe 188 PID 1368 set thread context of 216 1368 spoolsv.exe 190 PID 5128 set thread context of 5788 5128 spoolsv.exe 195 PID 512 set thread context of 5836 512 explorer.exe 197 PID 5792 set thread context of 5448 5792 spoolsv.exe 201 PID 6140 set thread context of 244 6140 explorer.exe 203 PID 5420 set thread context of 3344 5420 spoolsv.exe 208 PID 5648 set thread context of 4352 5648 explorer.exe 210 PID 1356 set thread context of 5248 1356 spoolsv.exe 213 PID 1188 set thread context of 5400 1188 explorer.exe 215 PID 2860 set thread context of 4108 2860 spoolsv.exe 218 PID 4852 set thread context of 2992 4852 explorer.exe 221 PID 5140 set thread context of 4796 5140 spoolsv.exe 223 PID 3060 set thread context of 2424 3060 explorer.exe 225 PID 5652 set thread context of 3760 5652 spoolsv.exe 227 PID 6080 set thread context of 3696 6080 spoolsv.exe 229 PID 4248 set thread context of 5688 4248 explorer.exe 231 PID 3968 set thread context of 4828 3968 spoolsv.exe 232 PID 4284 set thread context of 2152 4284 spoolsv.exe 233 PID 5748 set thread context of 3368 5748 spoolsv.exe 236 PID 4292 set thread context of 5992 4292 explorer.exe 238 PID 4884 set thread context of 4020 4884 spoolsv.exe 239 PID 5172 set thread context of 3752 5172 spoolsv.exe 241 PID 3268 set thread context of 1992 3268 spoolsv.exe 242 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 4964 spoolsv.exe 4964 spoolsv.exe 5184 spoolsv.exe 5184 spoolsv.exe 5244 explorer.exe 5244 explorer.exe 5364 spoolsv.exe 5364 spoolsv.exe 5424 spoolsv.exe 5424 spoolsv.exe 5484 spoolsv.exe 5484 spoolsv.exe 5556 spoolsv.exe 5556 spoolsv.exe 6096 spoolsv.exe 6096 spoolsv.exe 3592 spoolsv.exe 3592 spoolsv.exe 3328 spoolsv.exe 3328 spoolsv.exe 5176 spoolsv.exe 5176 spoolsv.exe 5588 spoolsv.exe 5588 spoolsv.exe 5724 spoolsv.exe 5724 spoolsv.exe 5784 spoolsv.exe 5784 spoolsv.exe 5884 spoolsv.exe 5884 spoolsv.exe 5960 spoolsv.exe 5960 spoolsv.exe 6004 spoolsv.exe 6004 spoolsv.exe 560 spoolsv.exe 560 spoolsv.exe 5208 spoolsv.exe 5208 spoolsv.exe 5384 spoolsv.exe 5384 spoolsv.exe 5428 spoolsv.exe 5428 spoolsv.exe 3200 spoolsv.exe 3200 spoolsv.exe 5904 spoolsv.exe 5904 spoolsv.exe 3496 spoolsv.exe 3496 spoolsv.exe 3712 spoolsv.exe 3712 spoolsv.exe 5680 spoolsv.exe 5680 spoolsv.exe 3784 spoolsv.exe 3784 spoolsv.exe 5472 spoolsv.exe 5472 spoolsv.exe 5728 spoolsv.exe 5728 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4836 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 86 PID 2348 wrote to memory of 4836 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 86 PID 2348 wrote to memory of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 2348 wrote to memory of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 2348 wrote to memory of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 2348 wrote to memory of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 2348 wrote to memory of 4508 2348 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 101 PID 4508 wrote to memory of 3104 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 102 PID 4508 wrote to memory of 3104 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 102 PID 4508 wrote to memory of 3104 4508 JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe 102 PID 3104 wrote to memory of 3004 3104 explorer.exe 111 PID 3104 wrote to memory of 3004 3104 explorer.exe 111 PID 3104 wrote to memory of 3004 3104 explorer.exe 111 PID 3104 wrote to memory of 3004 3104 explorer.exe 111 PID 3104 wrote to memory of 3004 3104 explorer.exe 111 PID 3004 wrote to memory of 376 3004 explorer.exe 112 PID 3004 wrote to memory of 376 3004 explorer.exe 112 PID 3004 wrote to memory of 376 3004 explorer.exe 112 PID 3004 wrote to memory of 5080 3004 explorer.exe 117 PID 3004 wrote to memory of 5080 3004 explorer.exe 117 PID 3004 wrote to memory of 5080 3004 explorer.exe 117 PID 2572 wrote to memory of 3128 2572 cmd.exe 118 PID 2572 wrote to memory of 3128 2572 cmd.exe 118 PID 2572 wrote to memory of 3128 2572 cmd.exe 118 PID 3004 wrote to memory of 4472 3004 explorer.exe 119 PID 3004 wrote to memory of 4472 3004 explorer.exe 119 PID 3004 wrote to memory of 4472 3004 explorer.exe 119 PID 3004 wrote to memory of 1800 3004 explorer.exe 120 PID 3004 wrote to memory of 1800 3004 explorer.exe 120 PID 3004 wrote to memory of 1800 3004 explorer.exe 120 PID 3004 wrote to memory of 3648 3004 explorer.exe 121 PID 3004 wrote to memory of 3648 3004 explorer.exe 121 PID 3004 wrote to memory of 3648 3004 explorer.exe 121 PID 3004 wrote to memory of 2856 3004 explorer.exe 122 PID 3004 wrote to memory of 2856 3004 explorer.exe 122 PID 3004 wrote to memory of 2856 3004 explorer.exe 122 PID 3004 wrote to memory of 3852 3004 explorer.exe 123 PID 3004 wrote to memory of 3852 3004 explorer.exe 123 PID 3004 wrote to memory of 3852 3004 explorer.exe 123 PID 3004 wrote to memory of 3528 3004 explorer.exe 124 PID 3004 wrote to memory of 3528 3004 explorer.exe 124 PID 3004 wrote to memory of 3528 3004 explorer.exe 124 PID 3004 wrote to memory of 1620 3004 explorer.exe 125 PID 3004 wrote to memory of 1620 3004 explorer.exe 125 PID 3004 wrote to memory of 1620 3004 explorer.exe 125 PID 3004 wrote to memory of 4556 3004 explorer.exe 126 PID 3004 wrote to memory of 4556 3004 explorer.exe 126 PID 3004 wrote to memory of 4556 3004 explorer.exe 126 PID 3004 wrote to memory of 3568 3004 explorer.exe 127 PID 3004 wrote to memory of 3568 3004 explorer.exe 127 PID 3004 wrote to memory of 3568 3004 explorer.exe 127 PID 3004 wrote to memory of 1124 3004 explorer.exe 128 PID 3004 wrote to memory of 1124 3004 explorer.exe 128 PID 3004 wrote to memory of 1124 3004 explorer.exe 128 PID 3004 wrote to memory of 4288 3004 explorer.exe 129 PID 3004 wrote to memory of 4288 3004 explorer.exe 129 PID 3004 wrote to memory of 4288 3004 explorer.exe 129 PID 3004 wrote to memory of 3972 3004 explorer.exe 130 PID 3004 wrote to memory of 3972 3004 explorer.exe 130 PID 3004 wrote to memory of 3972 3004 explorer.exe 130 PID 3004 wrote to memory of 2364 3004 explorer.exe 132 PID 3004 wrote to memory of 2364 3004 explorer.exe 132 PID 3004 wrote to memory of 2364 3004 explorer.exe 132 PID 3004 wrote to memory of 4160 3004 explorer.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_072b03cd5fbc369fd68bcf35be14a173.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4964 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:512 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5836
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5184
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4472 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5364
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5424
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5484
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6096 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6140 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:244
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3528 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3328
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5176
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3568 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5588 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5648 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4352
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1124 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5724
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5784
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3972 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5884
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4160 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6004
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5208 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1188 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:5400
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4832 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5384
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3168 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5428
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3200
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5904 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4852 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2992
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3496
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3712
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3336 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5680
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3784 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3060 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2424
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5472
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4900 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5728
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:216 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4248 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:5688
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5128 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5788
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4292 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:5992
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5792 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5448
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5320
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5420 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3344 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4384
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5248 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:380
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3444
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4796
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5652 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3696
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4644
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3968 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2152
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3368 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5800
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:4884 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5172 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3268 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1992
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5632
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5844 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5012
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6076
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4736
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5260
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5640
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3736
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5280
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:180
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1144
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe RO2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3128 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO1⤵PID:1244
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5c6a84aa40f43d4e72e9c53d90a7ccae5
SHA1e70b20d20703795cbeb104e7516f3fa62ef6ab5d
SHA256378bb3a40026fe41216b217258e9ccad0595fbbbe3341298831e1f6d3e59c1d1
SHA5122c6c75e314b5ecef97d5bc45cacce5489445786da050f0666d26001c2c1baa45589d8c256f2ee5505d0533f78536695ab13cfc4f248590218263be8557327ab8
-
Filesize
2.2MB
MD53d856d3a0100c1eb96a4ccf33ea4286b
SHA1bf030f58dad6da68a0128133b5fdf03599ad56a8
SHA25680dcce359e9af8a6b9a8aebee3a90a18345f8a6f0d3610cceec43dc4f7c34689
SHA512489ea41ca07155f59bcb7fec3988060595acaabeeaec26416e0480669eeb5e3a220fb04a6bcd3c4b4b9fdc02159f7efd19f3fcff0fed7f2f78c03e70043d56e5