Analysis
-
max time kernel
80s -
max time network
104s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/05/2025, 15:33
Behavioral task
behavioral1
Sample
JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe
Resource
win11-20250502-en
General
-
Target
JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe
-
Size
2.2MB
-
MD5
080d2a293751e6d785a73a11664845d0
-
SHA1
5f84d3fa42600199117b4713fea7a6f200e6da31
-
SHA256
eb83ad2266873e7f557a2b3d521a1593ec21a59bb05e8f3bcc240901a6a5f8db
-
SHA512
d7095e4e46b1c12b16fb1a496f36f82ac9764456f858d06e4dec2a7a486445a102354bb2fc98a05f94721cd520cfb9766846e66ab276abe76c38687f5c430ea0
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwl
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Detects Mofksys worm 59 IoCs
resource yara_rule behavioral2/memory/4764-39-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4764-40-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4764-58-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3508-94-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3508-460-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5780-1043-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1392-1060-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1392-1055-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3592-1067-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5416-1078-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2508-1107-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5504-1119-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2008-1144-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5780-1174-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5056-1181-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5624-1199-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2440-1209-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4576-1219-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3252-1277-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3252-1273-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5056-1295-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5448-1314-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4452-1331-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5448-1372-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1332-1438-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1760-1460-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1332-1511-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/124-1528-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/124-1557-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5924-1615-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1200-1622-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2428-1765-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4884-1793-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4884-1847-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4612-1957-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2424-2031-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4100-2047-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2396-2619-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2396-2673-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3492-2762-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3464-2992-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/3508-3069-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1852-3076-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/808-3126-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/968-3133-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4208-3154-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/1816-3166-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5764-3182-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5368-3189-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5764-3175-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/808-3236-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5364-3270-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4724-3267-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/912-3281-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/240-3297-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4068-3307-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/4548-3320-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/5676-3338-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys behavioral2/memory/2016-3391-0x0000000000400000-0x000000000043E000-memory.dmp family_mofksys -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-779059454-4269757009-3780780039-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Mofksys family
-
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe -
Executes dropped EXE 25 IoCs
pid Process 3132 explorer.exe 3508 explorer.exe 3100 spoolsv.exe 1208 spoolsv.exe 1404 explorer.exe 3748 spoolsv.exe 964 spoolsv.exe 5748 spoolsv.exe 4988 spoolsv.exe 1204 spoolsv.exe 4860 spoolsv.exe 4976 spoolsv.exe 5756 spoolsv.exe 3060 spoolsv.exe 2560 spoolsv.exe 1016 spoolsv.exe 1480 spoolsv.exe 3920 spoolsv.exe 1364 spoolsv.exe 2492 spoolsv.exe 5304 spoolsv.exe 4052 spoolsv.exe 3340 spoolsv.exe 3176 spoolsv.exe 4584 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1664 set thread context of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 3132 set thread context of 3508 3132 explorer.exe 88 -
Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe 3508 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3268 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 82 PID 1664 wrote to memory of 3268 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 82 PID 1664 wrote to memory of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 1664 wrote to memory of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 1664 wrote to memory of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 1664 wrote to memory of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 1664 wrote to memory of 4764 1664 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 86 PID 4764 wrote to memory of 3132 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 87 PID 4764 wrote to memory of 3132 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 87 PID 4764 wrote to memory of 3132 4764 JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe 87 PID 3132 wrote to memory of 3508 3132 explorer.exe 88 PID 3132 wrote to memory of 3508 3132 explorer.exe 88 PID 3132 wrote to memory of 3508 3132 explorer.exe 88 PID 3132 wrote to memory of 3508 3132 explorer.exe 88 PID 3132 wrote to memory of 3508 3132 explorer.exe 88 PID 3508 wrote to memory of 3100 3508 explorer.exe 89 PID 3508 wrote to memory of 3100 3508 explorer.exe 89 PID 3508 wrote to memory of 3100 3508 explorer.exe 89 PID 3508 wrote to memory of 1208 3508 explorer.exe 94 PID 3508 wrote to memory of 1208 3508 explorer.exe 94 PID 3508 wrote to memory of 1208 3508 explorer.exe 94 PID 4292 wrote to memory of 1404 4292 cmd.exe 95 PID 4292 wrote to memory of 1404 4292 cmd.exe 95 PID 4292 wrote to memory of 1404 4292 cmd.exe 95 PID 3508 wrote to memory of 3748 3508 explorer.exe 96 PID 3508 wrote to memory of 3748 3508 explorer.exe 96 PID 3508 wrote to memory of 3748 3508 explorer.exe 96 PID 3508 wrote to memory of 964 3508 explorer.exe 97 PID 3508 wrote to memory of 964 3508 explorer.exe 97 PID 3508 wrote to memory of 964 3508 explorer.exe 97 PID 3508 wrote to memory of 5748 3508 explorer.exe 98 PID 3508 wrote to memory of 5748 3508 explorer.exe 98 PID 3508 wrote to memory of 5748 3508 explorer.exe 98 PID 3508 wrote to memory of 4988 3508 explorer.exe 99 PID 3508 wrote to memory of 4988 3508 explorer.exe 99 PID 3508 wrote to memory of 4988 3508 explorer.exe 99 PID 3508 wrote to memory of 1204 3508 explorer.exe 100 PID 3508 wrote to memory of 1204 3508 explorer.exe 100 PID 3508 wrote to memory of 1204 3508 explorer.exe 100 PID 3508 wrote to memory of 4860 3508 explorer.exe 101 PID 3508 wrote to memory of 4860 3508 explorer.exe 101 PID 3508 wrote to memory of 4860 3508 explorer.exe 101 PID 3508 wrote to memory of 4976 3508 explorer.exe 102 PID 3508 wrote to memory of 4976 3508 explorer.exe 102 PID 3508 wrote to memory of 4976 3508 explorer.exe 102 PID 3508 wrote to memory of 5756 3508 explorer.exe 103 PID 3508 wrote to memory of 5756 3508 explorer.exe 103 PID 3508 wrote to memory of 5756 3508 explorer.exe 103 PID 3508 wrote to memory of 3060 3508 explorer.exe 104 PID 3508 wrote to memory of 3060 3508 explorer.exe 104 PID 3508 wrote to memory of 3060 3508 explorer.exe 104 PID 3508 wrote to memory of 2560 3508 explorer.exe 105 PID 3508 wrote to memory of 2560 3508 explorer.exe 105 PID 3508 wrote to memory of 2560 3508 explorer.exe 105 PID 3508 wrote to memory of 1016 3508 explorer.exe 106 PID 3508 wrote to memory of 1016 3508 explorer.exe 106 PID 3508 wrote to memory of 1016 3508 explorer.exe 106 PID 3508 wrote to memory of 1480 3508 explorer.exe 107 PID 3508 wrote to memory of 1480 3508 explorer.exe 107 PID 3508 wrote to memory of 1480 3508 explorer.exe 107 PID 3508 wrote to memory of 3920 3508 explorer.exe 108 PID 3508 wrote to memory of 3920 3508 explorer.exe 108 PID 3508 wrote to memory of 3920 3508 explorer.exe 108 PID 3508 wrote to memory of 1364 3508 explorer.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3268
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5780
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3080
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3492
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5416
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2508
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5748 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5504
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5056
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3384
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1852
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4976 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2440
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4576
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:720
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3252
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5448
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4908
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:968
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4452
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3920 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1332
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5136
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1816
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:124
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3496
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5368
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4052 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5924
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3556
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5364
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3340 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1200
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3176 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2428
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1980
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4068
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4884
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4968
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5676
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4320
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4612
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5192
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2016
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2240
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2424
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:2720
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5672
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:236
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4100
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4036
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1092
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2396
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4248
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5592
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3464
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4756
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1688
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:808
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1876
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1516
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4972
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4236
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4208
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6136
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5764
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3160
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4724
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1084
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1100
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2140
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:240
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2992
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4548
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5692
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1280
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5680
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2980
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5052
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2096
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:6092
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1916
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5484
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2028
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1476
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3752
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5940
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6084
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3660
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:400
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3844
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2204
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5108
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1236
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5884
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1532
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5684
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1248
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5300
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1372
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5028
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe RO2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1404 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"3⤵PID:3592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO1⤵PID:5576
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD5102fbdf641a72cc626b916f73a127ab3
SHA1dea883fa3f1f70f0eee9cd00b95db68a155b3b2b
SHA256d63cd4a77b5e2b4e1a31be59b95ea97fc005d053f25029ea05c7bf8f109e2558
SHA51221915a419f06f1f90412cefed270a14cdb16d42448c43385844368f5d8e3267ce60d043aeda30703f8fdec3168785a73fe0fec147be99b3677176803e4ab1fce
-
Filesize
2.2MB
MD504b1a8a4de5d0015236fb38845e8fc54
SHA162b73632a827773ce08b6bb12212dab5f92b1d65
SHA25601f89236e2eb49c644941b941ca4ed32f3b8a6c352a46a4b169be686d6b1d9c7
SHA51265a65eb611dc62fe9f698afa35517209bb8c88b996481c487617ebf49178ccb37226548d51c9f0f762ef0fe5cbc038abb528196dcf63acb82248ef84181c97d1