pony | 0f5777e54d13f05bce8cadcf7c15464e2235bd7f333650ac9a49be7b35150dae

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
Size

2.2MB
MD5

0682e8081d4b3d6f4e519ce2e8754983
SHA1

8f551de12b95effadb9e3c530cb81dd389ad3228
SHA256

0f5777e54d13f05bce8cadcf7c15464e2235bd7f333650ac9a49be7b35150dae
SHA512

a8be0c5dad0546df64178281c72a7f41c75cac148e20750007c91a763c1f0f04c94d4f7da028d7029b53f00c56ac7364f493449ee4c1282398d8c0df52bea335
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ2:0UzeyQMS4DqodCnoe+iitjWwwq

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1592	explorer.exe
2040	explorer.exe
1800	spoolsv.exe
1972	spoolsv.exe
2312	spoolsv.exe
692	spoolsv.exe
1564	spoolsv.exe
1160	spoolsv.exe
2484	spoolsv.exe
2564	spoolsv.exe
1224	spoolsv.exe
2460	spoolsv.exe
632	spoolsv.exe
1992	spoolsv.exe
2188	spoolsv.exe
2808	spoolsv.exe
1188	spoolsv.exe
2768	spoolsv.exe
2228	spoolsv.exe
1888	spoolsv.exe
2000	spoolsv.exe
2336	spoolsv.exe
2496	spoolsv.exe
968	spoolsv.exe
2732	spoolsv.exe
2276	spoolsv.exe
2708	spoolsv.exe
2832	spoolsv.exe
2996	spoolsv.exe
3040	spoolsv.exe
2760	spoolsv.exe
2256	spoolsv.exe
1672	spoolsv.exe
2444	spoolsv.exe
2944	spoolsv.exe
1072	spoolsv.exe
804	spoolsv.exe
1060	spoolsv.exe
2116	spoolsv.exe
2512	spoolsv.exe
2724	spoolsv.exe
1708	spoolsv.exe
2788	spoolsv.exe
2960	spoolsv.exe
2560	spoolsv.exe
2064	spoolsv.exe
2828	spoolsv.exe
2656	spoolsv.exe
1100	spoolsv.exe
2452	spoolsv.exe
2252	spoolsv.exe
2400	spoolsv.exe
1360	spoolsv.exe
1368	spoolsv.exe
280	spoolsv.exe
2908	spoolsv.exe
540	explorer.exe
1624	spoolsv.exe
1908	spoolsv.exe
2384	spoolsv.exe
940	spoolsv.exe
1988	spoolsv.exe
2796	spoolsv.exe
1264	explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 1592 set thread context of 2040	1592	explorer.exe	33
PID 1800 set thread context of 2908	1800	spoolsv.exe	87
PID 1972 set thread context of 1908	1972	spoolsv.exe	90
PID 2312 set thread context of 2384	2312	spoolsv.exe	91
PID 692 set thread context of 940	692	spoolsv.exe	92
PID 1564 set thread context of 2796	1564	spoolsv.exe	94
PID 1160 set thread context of 1440	1160	spoolsv.exe	96
PID 2484 set thread context of 3228	2484	spoolsv.exe	97
PID 2564 set thread context of 3244	2564	spoolsv.exe	98
PID 1224 set thread context of 3552	1224	spoolsv.exe	100
PID 2460 set thread context of 3632	2460	spoolsv.exe	101
PID 632 set thread context of 3828	632	spoolsv.exe	102
PID 1992 set thread context of 3840	1992	spoolsv.exe	103
PID 2808 set thread context of 4064	2808	spoolsv.exe	105
PID 2188 set thread context of 4072	2188	spoolsv.exe	106
PID 1188 set thread context of 1652	1188	spoolsv.exe	108
PID 1888 set thread context of 2200	1888	spoolsv.exe	109
PID 2768 set thread context of 3452	2768	spoolsv.exe	110
PID 2276 set thread context of 3464	2276	spoolsv.exe	111
PID 2336 set thread context of 3468	2336	spoolsv.exe	112
PID 2000 set thread context of 3480	2000	spoolsv.exe	113
PID 2228 set thread context of 3544	2228	spoolsv.exe	114
PID 280 set thread context of 2812	280	spoolsv.exe	115
PID 968 set thread context of 3648	968	spoolsv.exe	116
PID 2496 set thread context of 3904	2496	spoolsv.exe	117
PID 2832 set thread context of 3932	2832	spoolsv.exe	118
PID 3040 set thread context of 3968	3040	spoolsv.exe	120
PID 2732 set thread context of 4016	2732	spoolsv.exe	121
PID 2256 set thread context of 2368	2256	spoolsv.exe	122
PID 2708 set thread context of 980	2708	spoolsv.exe	123
PID 2760 set thread context of 2548	2760	spoolsv.exe	124
PID 2996 set thread context of 644	2996	spoolsv.exe	125
PID 2444 set thread context of 3044	2444	spoolsv.exe	126
PID 1060 set thread context of 580	1060	spoolsv.exe	127
PID 1072 set thread context of 2260	1072	spoolsv.exe	128
PID 2944 set thread context of 1920	2944	spoolsv.exe	129
PID 1672 set thread context of 2128	1672	spoolsv.exe	130
PID 2512 set thread context of 2696	2512	spoolsv.exe	131
PID 1708 set thread context of 2588	1708	spoolsv.exe	133
PID 2960 set thread context of 1760	2960	spoolsv.exe	132
PID 2064 set thread context of 3368	2064	spoolsv.exe	135
PID 2452 set thread context of 3340	2452	spoolsv.exe	137
PID 804 set thread context of 3456	804	spoolsv.exe	134
PID 2656 set thread context of 3376	2656	spoolsv.exe	136
PID 1368 set thread context of 2140	1368	spoolsv.exe	139
PID 2116 set thread context of 2380	2116	spoolsv.exe	138
PID 2400 set thread context of 3012	2400	spoolsv.exe	140
PID 2828 set thread context of 3728	2828	spoolsv.exe	141
PID 1100 set thread context of 3600	1100	spoolsv.exe	143
PID 2724 set thread context of 3736	2724	spoolsv.exe	142
PID 2560 set thread context of 3800	2560	spoolsv.exe	144
PID 2788 set thread context of 1252	2788	spoolsv.exe	145
PID 2252 set thread context of 3900	2252	spoolsv.exe	146
PID 1360 set thread context of 3920	1360	spoolsv.exe	147

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2040	explorer.exe
2908	spoolsv.exe
2908	spoolsv.exe
1908	spoolsv.exe
1908	spoolsv.exe
2384	spoolsv.exe
2384	spoolsv.exe
940	spoolsv.exe
940	spoolsv.exe
2796	spoolsv.exe
2796	spoolsv.exe
1440	spoolsv.exe
1440	spoolsv.exe
3228	spoolsv.exe
3228	spoolsv.exe
3244	spoolsv.exe
3244	spoolsv.exe
3552	spoolsv.exe
3552	spoolsv.exe
3632	spoolsv.exe
3632	spoolsv.exe
3840	spoolsv.exe
3828	spoolsv.exe
3840	spoolsv.exe
3828	spoolsv.exe
4064	spoolsv.exe
4064	spoolsv.exe
4072	spoolsv.exe
4072	spoolsv.exe
1652	spoolsv.exe
1652	spoolsv.exe
2200	spoolsv.exe
2200	spoolsv.exe
3452	spoolsv.exe
3452	spoolsv.exe
3464	spoolsv.exe
3464	spoolsv.exe
3468	spoolsv.exe
3468	spoolsv.exe
3480	spoolsv.exe
3480	spoolsv.exe
3544	spoolsv.exe
3544	spoolsv.exe
2812	spoolsv.exe
2812	spoolsv.exe
3904	spoolsv.exe
3904	spoolsv.exe
3648	spoolsv.exe
3648	spoolsv.exe
3968	spoolsv.exe
3968	spoolsv.exe
3932	spoolsv.exe
3932	spoolsv.exe
4016	spoolsv.exe
4016	spoolsv.exe
2368	spoolsv.exe
980	spoolsv.exe
2368	spoolsv.exe
980	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2900	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2900	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2900	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2900	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	28
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2232	2892	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	31
PID 2232 wrote to memory of 1592	2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	32
PID 2232 wrote to memory of 1592	2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	32
PID 2232 wrote to memory of 1592	2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	32
PID 2232 wrote to memory of 1592	2232	0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe	32
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 1592 wrote to memory of 2040	1592	explorer.exe	33
PID 2040 wrote to memory of 1800	2040	explorer.exe	34
PID 2040 wrote to memory of 1800	2040	explorer.exe	34
PID 2040 wrote to memory of 1800	2040	explorer.exe	34
PID 2040 wrote to memory of 1800	2040	explorer.exe	34
PID 2040 wrote to memory of 1972	2040	explorer.exe	35
PID 2040 wrote to memory of 1972	2040	explorer.exe	35
PID 2040 wrote to memory of 1972	2040	explorer.exe	35
PID 2040 wrote to memory of 1972	2040	explorer.exe	35
PID 2040 wrote to memory of 2312	2040	explorer.exe	36
PID 2040 wrote to memory of 2312	2040	explorer.exe	36
PID 2040 wrote to memory of 2312	2040	explorer.exe	36
PID 2040 wrote to memory of 2312	2040	explorer.exe	36
PID 2040 wrote to memory of 692	2040	explorer.exe	37
PID 2040 wrote to memory of 692	2040	explorer.exe	37
PID 2040 wrote to memory of 692	2040	explorer.exe	37
PID 2040 wrote to memory of 692	2040	explorer.exe	37
PID 2040 wrote to memory of 1564	2040	explorer.exe	38
PID 2040 wrote to memory of 1564	2040	explorer.exe	38
PID 2040 wrote to memory of 1564	2040	explorer.exe	38
PID 2040 wrote to memory of 1564	2040	explorer.exe	38
PID 2040 wrote to memory of 1160	2040	explorer.exe	39
PID 2040 wrote to memory of 1160	2040	explorer.exe	39
PID 2040 wrote to memory of 1160	2040	explorer.exe	39
PID 2040 wrote to memory of 1160	2040	explorer.exe	39
PID 2040 wrote to memory of 2484	2040	explorer.exe	40
PID 2040 wrote to memory of 2484	2040	explorer.exe	40
PID 2040 wrote to memory of 2484	2040	explorer.exe	40
PID 2040 wrote to memory of 2484	2040	explorer.exe	40
PID 2040 wrote to memory of 2564	2040	explorer.exe	41
PID 2040 wrote to memory of 2564	2040	explorer.exe	41
PID 2040 wrote to memory of 2564	2040	explorer.exe	41
PID 2040 wrote to memory of 2564	2040	explorer.exe	41
PID 2040 wrote to memory of 1224	2040	explorer.exe	42
PID 2040 wrote to memory of 1224	2040	explorer.exe	42
PID 2040 wrote to memory of 1224	2040	explorer.exe	42
PID 2040 wrote to memory of 1224	2040	explorer.exe	42
PID 2040 wrote to memory of 2460	2040	explorer.exe	43
PID 2040 wrote to memory of 2460	2040	explorer.exe	43
PID 2040 wrote to memory of 2460	2040	explorer.exe	43
PID 2040 wrote to memory of 2460	2040	explorer.exe	43
PID 2040 wrote to memory of 632	2040	explorer.exe	44
PID 2040 wrote to memory of 632	2040	explorer.exe	44
PID 2040 wrote to memory of 632	2040	explorer.exe	44
PID 2040 wrote to memory of 632	2040	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0682e8081d4b3d6f4e519ce2e8754983_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2232
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2908
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
d9fc5b6f4f9214ddb0d0aa1d12881d15

SHA1
989fbd806b447ff450e74360b8362d9bf9dc7fac

SHA256
ff79a7fd7d19e2fcd3e6c1014919d598554ad428e1a098ac6631f21a0d1562f7

SHA512
f3ca2feded67c8176cd6b61f7aeb1ac31bf041e718fef3bdd9dace00a537044142355a95aef74c41e8c775bb5927290fd51a356b3d6d3be6ea9bfee6d6b29ede

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
4d3e3024685b43009c1959a4c5522d39

SHA1
8a527b0d36ea5edd2dc4a76d1f8e8c2b8c12d921

SHA256
d99915588e2c5b4e2e5ef0c12769bcc6e9bff20b046416a945661ce705b565a4

SHA512
38ecd0511945150a6b35d65286ba6ad59988f370219e82bd1eefaf9769f32a62fd0e9cfc21b8b6ae147a209f2c297728b7d1659ed97293f3040b229cd69b25c1

Download Submit
memory/632-1463-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/644-2986-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/692-1251-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/940-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/968-1787-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/980-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1160-1458-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1188-1627-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1224-1461-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1252-3086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1440-2372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-1252-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1592-59-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1592-67-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1592-38-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1592-57-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1800-1049-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1888-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1908-2269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-2990-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1972-1050-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1992-1621-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2000-1784-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2040-1048-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-3053-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2140-3081-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2188-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2200-2603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-1629-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2232-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2232-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-22-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-2203-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2260-3021-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-1799-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2312-1051-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2336-1785-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2380-3082-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2384-2283-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2460-1462-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2484-1459-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2496-1786-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2564-1460-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2708-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2732-1793-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2760-1997-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2768-1628-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2796-2358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2832-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2892-23-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2892-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2892-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2892-12-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2908-2233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2996-1985-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3012-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3040-1986-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3228-2389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3244-2421-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3340-3068-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3368-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3452-2618-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-3119-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3468-2647-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3480-2652-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3552-2449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-2470-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-3084-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3736-3085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3800-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-2976-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-2989-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4016-2984-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4064-2974-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4064-2556-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4072-2559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download