Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/05/2025, 05:30
Behavioral task
behavioral1
Sample
JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe
Resource
win11-20250502-en
General
-
Target
JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe
-
Size
2.2MB
-
MD5
07360e5e4a86e69b56627c7a048313f4
-
SHA1
b4aefcc05c5e7c32bd1a2086d608474a5439a6d3
-
SHA256
6cb01373c18e6bfc6ab0a17bb25bf309797ae1ebd6f15635bf44a85633d6ac66
-
SHA512
db6fd79caabbf2675756e3bb860b14466698cbe84fe08493d0ae7943093b1e4e601271be46974c6efb5653f9d599c47824d874502a0244dd9919cfbe783db66f
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwg
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Detects Mofksys worm 64 IoCs
resource yara_rule behavioral2/memory/2400-45-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2400-46-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2400-64-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2268-100-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2268-474-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5264-1212-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2604-1229-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4964-1234-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5660-1246-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2328-1253-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1540-1264-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5300-1275-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5264-1326-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5668-1367-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5968-1374-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1672-1385-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5668-1415-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4660-1444-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5140-1455-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2316-1490-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4296-1556-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1904-1637-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4296-1647-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/6024-1685-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2132-1705-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3088-1713-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3088-1718-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/6024-1771-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4816-1786-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5828-1807-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4132-1818-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4112-1837-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4816-1891-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1032-1898-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1600-1920-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1336-1928-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1032-1979-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/708-2010-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/708-2063-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4956-2136-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2288-2340-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4636-2351-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4004-2451-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5652-2622-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2268-2640-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4628-2665-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5200-2692-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1828-2803-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2380-2852-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2568-2915-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/440-2926-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4108-3037-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4228-3082-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/6092-3203-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4300-3212-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5564-3226-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1192-3248-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/6048-3265-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4880-3260-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3760-3283-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3760-3287-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4828-3297-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2188-3304-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1240-3372-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1178639776-3244803473-3821071008-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Mofksys family
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe explorer.exe -
Executes dropped EXE 64 IoCs
pid Process 1088 explorer.exe 2268 explorer.exe 6080 spoolsv.exe 4332 spoolsv.exe 5316 explorer.exe 784 spoolsv.exe 5388 spoolsv.exe 1060 spoolsv.exe 1052 spoolsv.exe 3368 spoolsv.exe 5272 spoolsv.exe 4836 spoolsv.exe 2284 spoolsv.exe 2208 spoolsv.exe 5424 spoolsv.exe 2424 spoolsv.exe 3224 spoolsv.exe 5700 spoolsv.exe 5860 spoolsv.exe 2196 spoolsv.exe 1368 spoolsv.exe 5904 spoolsv.exe 1928 spoolsv.exe 3120 spoolsv.exe 5152 spoolsv.exe 1500 spoolsv.exe 1896 spoolsv.exe 3668 spoolsv.exe 2464 spoolsv.exe 2724 spoolsv.exe 3860 spoolsv.exe 4556 spoolsv.exe 5240 spoolsv.exe 804 spoolsv.exe 5264 spoolsv.exe 2936 explorer.exe 2604 spoolsv.exe 4964 explorer.exe 5660 spoolsv.exe 2328 spoolsv.exe 1540 spoolsv.exe 5300 spoolsv.exe 428 spoolsv.exe 5668 spoolsv.exe 1012 explorer.exe 5968 spoolsv.exe 1672 spoolsv.exe 3520 spoolsv.exe 4660 spoolsv.exe 5452 explorer.exe 5140 spoolsv.exe 2416 spoolsv.exe 2316 spoolsv.exe 340 spoolsv.exe 4296 spoolsv.exe 2076 explorer.exe 4684 spoolsv.exe 5960 spoolsv.exe 1348 spoolsv.exe 1904 spoolsv.exe 2216 spoolsv.exe 6024 spoolsv.exe 5708 explorer.exe 2132 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 38 IoCs
description pid Process procid_target PID 4572 set thread context of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 1088 set thread context of 2268 1088 explorer.exe 87 PID 6080 set thread context of 5264 6080 spoolsv.exe 124 PID 4332 set thread context of 2604 4332 spoolsv.exe 126 PID 5316 set thread context of 4964 5316 explorer.exe 127 PID 784 set thread context of 5660 784 spoolsv.exe 128 PID 5388 set thread context of 2328 5388 spoolsv.exe 129 PID 1060 set thread context of 1540 1060 spoolsv.exe 130 PID 1052 set thread context of 5300 1052 spoolsv.exe 131 PID 3368 set thread context of 5668 3368 spoolsv.exe 133 PID 5272 set thread context of 5968 5272 spoolsv.exe 135 PID 4836 set thread context of 1672 4836 spoolsv.exe 136 PID 2284 set thread context of 4660 2284 spoolsv.exe 138 PID 2208 set thread context of 5140 2208 spoolsv.exe 140 PID 5424 set thread context of 2316 5424 spoolsv.exe 142 PID 2424 set thread context of 340 2424 spoolsv.exe 143 PID 3224 set thread context of 4296 3224 spoolsv.exe 144 PID 5700 set thread context of 5960 5700 spoolsv.exe 147 PID 5860 set thread context of 1348 5860 spoolsv.exe 148 PID 2196 set thread context of 1904 2196 spoolsv.exe 149 PID 1368 set thread context of 6024 1368 spoolsv.exe 151 PID 5904 set thread context of 2132 5904 spoolsv.exe 153 PID 1928 set thread context of 3088 1928 spoolsv.exe 154 PID 3120 set thread context of 4816 3120 spoolsv.exe 156 PID 5152 set thread context of 5828 5152 spoolsv.exe 158 PID 1500 set thread context of 4132 1500 spoolsv.exe 159 PID 1896 set thread context of 4112 1896 spoolsv.exe 160 PID 3668 set thread context of 1032 3668 spoolsv.exe 162 PID 2464 set thread context of 1600 2464 spoolsv.exe 164 PID 2724 set thread context of 1336 2724 spoolsv.exe 165 PID 3860 set thread context of 3064 3860 spoolsv.exe 166 PID 4556 set thread context of 708 4556 spoolsv.exe 168 PID 5240 set thread context of 4956 5240 spoolsv.exe 171 PID 804 set thread context of 2288 804 spoolsv.exe 179 PID 2936 set thread context of 4636 2936 explorer.exe 181 PID 428 set thread context of 4004 428 spoolsv.exe 184 PID 1012 set thread context of 3796 1012 explorer.exe 186 PID 3520 set thread context of 5652 3520 spoolsv.exe 189 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe File opened for modification \??\c:\windows\system\explorer.exe JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 2268 explorer.exe 5264 spoolsv.exe 5264 spoolsv.exe 2604 spoolsv.exe 2604 spoolsv.exe 4964 explorer.exe 4964 explorer.exe 5660 spoolsv.exe 5660 spoolsv.exe 2328 spoolsv.exe 2328 spoolsv.exe 1540 spoolsv.exe 1540 spoolsv.exe 5300 spoolsv.exe 5300 spoolsv.exe 5668 spoolsv.exe 5668 spoolsv.exe 5968 spoolsv.exe 5968 spoolsv.exe 1672 spoolsv.exe 1672 spoolsv.exe 4660 spoolsv.exe 4660 spoolsv.exe 5140 spoolsv.exe 5140 spoolsv.exe 2316 spoolsv.exe 2316 spoolsv.exe 340 spoolsv.exe 340 spoolsv.exe 4296 spoolsv.exe 4296 spoolsv.exe 5960 spoolsv.exe 5960 spoolsv.exe 1348 spoolsv.exe 1348 spoolsv.exe 1904 spoolsv.exe 1904 spoolsv.exe 6024 spoolsv.exe 6024 spoolsv.exe 2132 spoolsv.exe 2132 spoolsv.exe 3088 spoolsv.exe 3088 spoolsv.exe 4816 spoolsv.exe 4816 spoolsv.exe 5828 spoolsv.exe 5828 spoolsv.exe 4132 spoolsv.exe 4132 spoolsv.exe 4112 spoolsv.exe 4112 spoolsv.exe 1032 spoolsv.exe 1032 spoolsv.exe 1600 spoolsv.exe 1600 spoolsv.exe 1336 spoolsv.exe 1336 spoolsv.exe 3064 spoolsv.exe 3064 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 5856 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 82 PID 4572 wrote to memory of 5856 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 82 PID 4572 wrote to memory of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 4572 wrote to memory of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 4572 wrote to memory of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 4572 wrote to memory of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 4572 wrote to memory of 2400 4572 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 85 PID 2400 wrote to memory of 1088 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 86 PID 2400 wrote to memory of 1088 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 86 PID 2400 wrote to memory of 1088 2400 JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe 86 PID 1088 wrote to memory of 2268 1088 explorer.exe 87 PID 1088 wrote to memory of 2268 1088 explorer.exe 87 PID 1088 wrote to memory of 2268 1088 explorer.exe 87 PID 1088 wrote to memory of 2268 1088 explorer.exe 87 PID 1088 wrote to memory of 2268 1088 explorer.exe 87 PID 2268 wrote to memory of 6080 2268 explorer.exe 88 PID 2268 wrote to memory of 6080 2268 explorer.exe 88 PID 2268 wrote to memory of 6080 2268 explorer.exe 88 PID 2268 wrote to memory of 4332 2268 explorer.exe 93 PID 2268 wrote to memory of 4332 2268 explorer.exe 93 PID 2268 wrote to memory of 4332 2268 explorer.exe 93 PID 5124 wrote to memory of 5316 5124 cmd.exe 94 PID 5124 wrote to memory of 5316 5124 cmd.exe 94 PID 5124 wrote to memory of 5316 5124 cmd.exe 94 PID 2268 wrote to memory of 784 2268 explorer.exe 95 PID 2268 wrote to memory of 784 2268 explorer.exe 95 PID 2268 wrote to memory of 784 2268 explorer.exe 95 PID 2268 wrote to memory of 5388 2268 explorer.exe 96 PID 2268 wrote to memory of 5388 2268 explorer.exe 96 PID 2268 wrote to memory of 5388 2268 explorer.exe 96 PID 2268 wrote to memory of 1060 2268 explorer.exe 97 PID 2268 wrote to memory of 1060 2268 explorer.exe 97 PID 2268 wrote to memory of 1060 2268 explorer.exe 97 PID 2268 wrote to memory of 1052 2268 explorer.exe 98 PID 2268 wrote to memory of 1052 2268 explorer.exe 98 PID 2268 wrote to memory of 1052 2268 explorer.exe 98 PID 2268 wrote to memory of 3368 2268 explorer.exe 99 PID 2268 wrote to memory of 3368 2268 explorer.exe 99 PID 2268 wrote to memory of 3368 2268 explorer.exe 99 PID 2268 wrote to memory of 5272 2268 explorer.exe 100 PID 2268 wrote to memory of 5272 2268 explorer.exe 100 PID 2268 wrote to memory of 5272 2268 explorer.exe 100 PID 2268 wrote to memory of 4836 2268 explorer.exe 101 PID 2268 wrote to memory of 4836 2268 explorer.exe 101 PID 2268 wrote to memory of 4836 2268 explorer.exe 101 PID 2268 wrote to memory of 2284 2268 explorer.exe 102 PID 2268 wrote to memory of 2284 2268 explorer.exe 102 PID 2268 wrote to memory of 2284 2268 explorer.exe 102 PID 2268 wrote to memory of 2208 2268 explorer.exe 103 PID 2268 wrote to memory of 2208 2268 explorer.exe 103 PID 2268 wrote to memory of 2208 2268 explorer.exe 103 PID 2268 wrote to memory of 5424 2268 explorer.exe 104 PID 2268 wrote to memory of 5424 2268 explorer.exe 104 PID 2268 wrote to memory of 5424 2268 explorer.exe 104 PID 2268 wrote to memory of 2424 2268 explorer.exe 105 PID 2268 wrote to memory of 2424 2268 explorer.exe 105 PID 2268 wrote to memory of 2424 2268 explorer.exe 105 PID 2268 wrote to memory of 3224 2268 explorer.exe 106 PID 2268 wrote to memory of 3224 2268 explorer.exe 106 PID 2268 wrote to memory of 3224 2268 explorer.exe 106 PID 2268 wrote to memory of 5700 2268 explorer.exe 107 PID 2268 wrote to memory of 5700 2268 explorer.exe 107 PID 2268 wrote to memory of 5700 2268 explorer.exe 107 PID 2268 wrote to memory of 5860 2268 explorer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:5856
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07360e5e4a86e69b56627c7a048313f4.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:6080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5264 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2936 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:4636
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2604
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:784 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5660
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2328
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5300
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5668 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1012 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- System Location Discovery: System Language Discovery
PID:3796
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5272 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4836 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4660 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5452 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4628
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5140
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:340
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4296 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2076 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1828
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5700 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5960
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1348
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6024 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5708 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:440
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5904 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2132
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1928 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3088
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3120 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4816 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:5624 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4228
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5152 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4132
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4112
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3668 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1032 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4796 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4300
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2724 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3064
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:708
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:6120 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4152
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5240 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4956 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:576 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:6048
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:804 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3684 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5760
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4004 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5728 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2760
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3520 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5652 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4008
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3576
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5200
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2888
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2380
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:6124
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2216 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2568
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4068
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4108
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2396
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1704 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6092
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:6100
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5436 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1192
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5160
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3180 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4828
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1240
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4104
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1220
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5808
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3680
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- System Location Discovery: System Language Discovery
PID:4392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2176
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2776
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3236
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1676
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6016
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1252
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:336
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4044
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4832
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6012
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4844
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe RO2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5316 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO1⤵PID:5136
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5fdfc71e405be3af4b211673a504432fb
SHA1f765ce05a09c73858f0c517e4d0154c2a901736f
SHA25671571792ad245b7c159f5bdda9fe1f2e3b8d63b42dcb0de29e2ec101d20c3a55
SHA51282480a29d8dd6e131b2692d08478e3f56c7d5e713f140cdba95f936dc18d4fba5c680b0a5711a3edd1bc95519a878753ba77a01e0f280a30de2c1d093eecc1b8
-
Filesize
2.2MB
MD5d665c559d412a1d9681fd77d28308601
SHA177335575e0729f038c67a8abd03194b6c491b82a
SHA2564ae01c77b78e835e5e45e8edf15d5ee297f05cd90bacaacac9f105c3e3c10a0c
SHA512d9abf56337347e608a54620fe42d3f395cac0e78dabffdf644c3059427a6c83ef61682db9891025b9d63ec625263ee584ed18b2d19674a66a66e6c4f9d839ca0