pony | 961f04770851408277e71fb089899c210c74d6a768aaf21f9ba23175fd0e8ef1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
Size

2.2MB
MD5

044f1beba281129bb335c7d87311a468
SHA1

ea8cef33799449e83c4af412dc52205b9b86a97f
SHA256

961f04770851408277e71fb089899c210c74d6a768aaf21f9ba23175fd0e8ef1
SHA512

ba10b8a2f0d41eefd1de0cd61ee73c9e111565374c55b8997d6e0f308bcc9a90f25c4bcf44da32949da21dd512c57bb6eac7166a388db515c9df4c9ad754eaed
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwi

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3216	explorer.exe
2880	explorer.exe
5100	spoolsv.exe
1964	spoolsv.exe
2432	spoolsv.exe
3596	spoolsv.exe
2584	spoolsv.exe
4992	spoolsv.exe
3232	spoolsv.exe
4732	spoolsv.exe
4416	spoolsv.exe
4168	spoolsv.exe
840	spoolsv.exe
4444	spoolsv.exe
2128	spoolsv.exe
2976	spoolsv.exe
4768	spoolsv.exe
3076	spoolsv.exe
2332	spoolsv.exe
3168	spoolsv.exe
1564	spoolsv.exe
1272	spoolsv.exe
3432	spoolsv.exe
684	spoolsv.exe
4748	spoolsv.exe
5032	spoolsv.exe
2156	spoolsv.exe
3112	spoolsv.exe
228	spoolsv.exe
3620	spoolsv.exe
4068	spoolsv.exe
5112	spoolsv.exe
2876	spoolsv.exe
3960	explorer.exe
1160	spoolsv.exe
3632	spoolsv.exe
2368	spoolsv.exe
2924	spoolsv.exe
1776	spoolsv.exe
224	explorer.exe
624	spoolsv.exe
660	spoolsv.exe
3408	spoolsv.exe
2148	spoolsv.exe
5048	spoolsv.exe
1628	spoolsv.exe
2316	spoolsv.exe
4644	explorer.exe
464	spoolsv.exe
2480	spoolsv.exe
2508	spoolsv.exe
4388	spoolsv.exe
664	explorer.exe
4672	spoolsv.exe
2324	spoolsv.exe
4880	spoolsv.exe
2180	spoolsv.exe
1408	spoolsv.exe
4572	spoolsv.exe
944	spoolsv.exe
1164	explorer.exe
4268	spoolsv.exe
2060	spoolsv.exe
4316	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 3216 set thread context of 2880	3216	explorer.exe	97
PID 5100 set thread context of 2876	5100	spoolsv.exe	130
PID 1964 set thread context of 1160	1964	spoolsv.exe	132
PID 2432 set thread context of 3632	2432	spoolsv.exe	133
PID 3596 set thread context of 2368	3596	spoolsv.exe	134
PID 2584 set thread context of 1776	2584	spoolsv.exe	136
PID 4992 set thread context of 624	4992	spoolsv.exe	138
PID 3232 set thread context of 660	3232	spoolsv.exe	139
PID 4732 set thread context of 3408	4732	spoolsv.exe	140
PID 4416 set thread context of 2148	4416	spoolsv.exe	141
PID 4168 set thread context of 5048	4168	spoolsv.exe	142
PID 840 set thread context of 2316	840	spoolsv.exe	144
PID 4444 set thread context of 464	4444	spoolsv.exe	146
PID 2128 set thread context of 2480	2128	spoolsv.exe	147
PID 2976 set thread context of 2508	2976	spoolsv.exe	148
PID 4768 set thread context of 4388	4768	spoolsv.exe	149
PID 3076 set thread context of 2324	3076	spoolsv.exe	152
PID 2332 set thread context of 4880	2332	spoolsv.exe	153
PID 3168 set thread context of 2180	3168	spoolsv.exe	154
PID 1564 set thread context of 1408	1564	spoolsv.exe	155
PID 1272 set thread context of 944	1272	spoolsv.exe	157
PID 3432 set thread context of 4268	3432	spoolsv.exe	159
PID 684 set thread context of 2060	684	spoolsv.exe	160
PID 4748 set thread context of 4316	4748	spoolsv.exe	161
PID 5032 set thread context of 3688	5032	spoolsv.exe	162
PID 2156 set thread context of 2308	2156	spoolsv.exe	163
PID 3112 set thread context of 3440	3112	spoolsv.exe	166
PID 228 set thread context of 4944	228	spoolsv.exe	167
PID 3620 set thread context of 2660	3620	spoolsv.exe	168
PID 4068 set thread context of 3656	4068	spoolsv.exe	170
PID 5112 set thread context of 3944	5112	spoolsv.exe	174
PID 3960 set thread context of 1520	3960	explorer.exe	176
PID 2924 set thread context of 2872	2924	spoolsv.exe	181
PID 224 set thread context of 4724	224	explorer.exe	183
PID 4644 set thread context of 3124	4644	explorer.exe	187
PID 1628 set thread context of 1880	1628	spoolsv.exe	188
PID 664 set thread context of 1444	664	explorer.exe	193
PID 4672 set thread context of 1092	4672	spoolsv.exe	194
PID 1164 set thread context of 212	1164	explorer.exe	200
PID 4572 set thread context of 1208	4572	spoolsv.exe	201
PID 4472 set thread context of 3152	4472	spoolsv.exe	206
PID 2400 set thread context of 1264	2400	explorer.exe	208
PID 220 set thread context of 768	220	spoolsv.exe	209
PID 4740 set thread context of 1260	4740	explorer.exe	210
PID 5108 set thread context of 364	5108	spoolsv.exe	211
PID 4284 set thread context of 796	4284	spoolsv.exe	213
PID 3140 set thread context of 1156	3140	explorer.exe	215
PID 3600 set thread context of 2908	3600	spoolsv.exe	216
PID 4664 set thread context of 4916	4664	spoolsv.exe	218
PID 4540 set thread context of 4928	4540	spoolsv.exe	219
PID 4088 set thread context of 1524	4088	spoolsv.exe	221
PID 3864 set thread context of 2920	3864	explorer.exe	223
PID 4552 set thread context of 1916	4552	spoolsv.exe	224

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2880	explorer.exe
2876	spoolsv.exe
2876	spoolsv.exe
1160	spoolsv.exe
1160	spoolsv.exe
3632	spoolsv.exe
3632	spoolsv.exe
2368	spoolsv.exe
2368	spoolsv.exe
1776	spoolsv.exe
1776	spoolsv.exe
624	spoolsv.exe
624	spoolsv.exe
660	spoolsv.exe
660	spoolsv.exe
3408	spoolsv.exe
3408	spoolsv.exe
2148	spoolsv.exe
2148	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe
2316	spoolsv.exe
2316	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
2480	spoolsv.exe
2480	spoolsv.exe
2508	spoolsv.exe
2508	spoolsv.exe
4388	spoolsv.exe
4388	spoolsv.exe
2324	spoolsv.exe
2324	spoolsv.exe
4880	spoolsv.exe
4880	spoolsv.exe
2180	spoolsv.exe
2180	spoolsv.exe
1408	spoolsv.exe
1408	spoolsv.exe
944	spoolsv.exe
944	spoolsv.exe
4268	spoolsv.exe
4268	spoolsv.exe
2060	spoolsv.exe
2060	spoolsv.exe
4316	spoolsv.exe
4316	spoolsv.exe
3688	spoolsv.exe
3688	spoolsv.exe
2308	spoolsv.exe
2308	spoolsv.exe
3440	spoolsv.exe
3440	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe
2660	spoolsv.exe
2660	spoolsv.exe
3656	spoolsv.exe
3656	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 532	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	83
PID 1088 wrote to memory of 532	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	83
PID 1088 wrote to memory of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 1088 wrote to memory of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 1088 wrote to memory of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 1088 wrote to memory of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 1088 wrote to memory of 2836	1088	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	88
PID 2836 wrote to memory of 3216	2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	89
PID 2836 wrote to memory of 3216	2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	89
PID 2836 wrote to memory of 3216	2836	044f1beba281129bb335c7d87311a468_JaffaCakes118.exe	89
PID 3216 wrote to memory of 2880	3216	explorer.exe	97
PID 3216 wrote to memory of 2880	3216	explorer.exe	97
PID 3216 wrote to memory of 2880	3216	explorer.exe	97
PID 3216 wrote to memory of 2880	3216	explorer.exe	97
PID 3216 wrote to memory of 2880	3216	explorer.exe	97
PID 2880 wrote to memory of 5100	2880	explorer.exe	98
PID 2880 wrote to memory of 5100	2880	explorer.exe	98
PID 2880 wrote to memory of 5100	2880	explorer.exe	98
PID 2880 wrote to memory of 1964	2880	explorer.exe	99
PID 2880 wrote to memory of 1964	2880	explorer.exe	99
PID 2880 wrote to memory of 1964	2880	explorer.exe	99
PID 2880 wrote to memory of 2432	2880	explorer.exe	100
PID 2880 wrote to memory of 2432	2880	explorer.exe	100
PID 2880 wrote to memory of 2432	2880	explorer.exe	100
PID 2880 wrote to memory of 3596	2880	explorer.exe	101
PID 2880 wrote to memory of 3596	2880	explorer.exe	101
PID 2880 wrote to memory of 3596	2880	explorer.exe	101
PID 2880 wrote to memory of 2584	2880	explorer.exe	102
PID 2880 wrote to memory of 2584	2880	explorer.exe	102
PID 2880 wrote to memory of 2584	2880	explorer.exe	102
PID 2880 wrote to memory of 4992	2880	explorer.exe	103
PID 2880 wrote to memory of 4992	2880	explorer.exe	103
PID 2880 wrote to memory of 4992	2880	explorer.exe	103
PID 2880 wrote to memory of 3232	2880	explorer.exe	104
PID 2880 wrote to memory of 3232	2880	explorer.exe	104
PID 2880 wrote to memory of 3232	2880	explorer.exe	104
PID 2880 wrote to memory of 4732	2880	explorer.exe	105
PID 2880 wrote to memory of 4732	2880	explorer.exe	105
PID 2880 wrote to memory of 4732	2880	explorer.exe	105
PID 2880 wrote to memory of 4416	2880	explorer.exe	106
PID 2880 wrote to memory of 4416	2880	explorer.exe	106
PID 2880 wrote to memory of 4416	2880	explorer.exe	106
PID 2880 wrote to memory of 4168	2880	explorer.exe	107
PID 2880 wrote to memory of 4168	2880	explorer.exe	107
PID 2880 wrote to memory of 4168	2880	explorer.exe	107
PID 2880 wrote to memory of 840	2880	explorer.exe	110
PID 2880 wrote to memory of 840	2880	explorer.exe	110
PID 2880 wrote to memory of 840	2880	explorer.exe	110
PID 2880 wrote to memory of 4444	2880	explorer.exe	111
PID 2880 wrote to memory of 4444	2880	explorer.exe	111
PID 2880 wrote to memory of 4444	2880	explorer.exe	111
PID 2880 wrote to memory of 2128	2880	explorer.exe	112
PID 2880 wrote to memory of 2128	2880	explorer.exe	112
PID 2880 wrote to memory of 2128	2880	explorer.exe	112
PID 2880 wrote to memory of 2976	2880	explorer.exe	113
PID 2880 wrote to memory of 2976	2880	explorer.exe	113
PID 2880 wrote to memory of 2976	2880	explorer.exe	113
PID 2880 wrote to memory of 4768	2880	explorer.exe	114
PID 2880 wrote to memory of 4768	2880	explorer.exe	114
PID 2880 wrote to memory of 4768	2880	explorer.exe	114
PID 2880 wrote to memory of 3076	2880	explorer.exe	115
PID 2880 wrote to memory of 3076	2880	explorer.exe	115
PID 2880 wrote to memory of 3076	2880	explorer.exe	115
PID 2880 wrote to memory of 2332	2880	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:532
- C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\044f1beba281129bb335c7d87311a468_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3960
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4644
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:664
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1164
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2400
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3656
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4740
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3864
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:8
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
3780db0342ed000c2b6c145fc9fd41b5

SHA1
2b3f75af69cf71500a284849deed6eea4d476443

SHA256
761c0d271f56e95c151b6e07b7866bf83e166be16478e06f57227a1ccc0b9756

SHA512
ceae4ee69b7703762224d67c53f7f86043187df3cf7007fe26a24b376f0ada65859f81fcf8f6aac603d77020871bbd9ac50782333f3d58d63c0200843810cd56

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
7229273f5c52b691d63768c424c04b55

SHA1
f4144a03b07f5e11a7f93c4065dde4453997ec91

SHA256
8550f19a477edfae0d6a9a718b56244d6a1ca3bc4032571ede7b5db81d4aaa64

SHA512
a53d58bb08e218f2f8eb74fd48a6b897ffed263afaa14a5bd98d1aa7f5b51ca135dd7b353bec52dba8711ea2e76cc6765ac837dd4404253cce2c485b8e4e410b

Download Submit
memory/212-4364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/364-4655-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/624-2118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/660-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/684-1954-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/768-4632-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/796-4790-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/796-4975-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/840-1471-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/944-2748-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/944-2654-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1088-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1088-23-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1088-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1088-29-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1092-4162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1092-4074-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1156-4798-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1160-1944-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1208-4515-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-4643-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-4646-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1264-4624-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-1945-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1408-2508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-4067-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-3226-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-3224-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-1923-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1776-2110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-3932-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-3815-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-5061-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1964-1947-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1964-980-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2060-2674-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-2678-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-1646-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2148-2149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2180-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2308-2774-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2308-3016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2316-2256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2332-1782-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2368-1985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2368-1983-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2432-981-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2432-1957-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2508-2282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2584-1123-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2836-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2836-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2836-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-1924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-2081-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2880-773-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2880-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-4806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-5055-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2976-1647-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3076-1781-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3124-3807-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3152-4768-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3152-4614-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3168-1922-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3216-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3216-64-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3232-1270-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3408-2137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3408-2140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3432-1946-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3440-2864-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3596-982-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3632-1955-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3636-5134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3656-3126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3656-3033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3944-3349-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3944-3215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4168-1470-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4268-2665-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-2374-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-2558-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4416-1272-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4444-1472-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4724-3560-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4732-1271-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4748-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4768-1648-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4880-2469-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4928-4932-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4944-2874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-1124-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5100-1919-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5100-774-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download