pony | 840da0bef50a0e9882411ce0ecac356613784c932588a23c57a22966a6b823a5

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
Size

2.2MB
MD5

176a5933985418f3a5cbefb3012e9069
SHA1

c6091fca7df7ce288f29790b72e6398d4b340c75
SHA256

840da0bef50a0e9882411ce0ecac356613784c932588a23c57a22966a6b823a5
SHA512

57cdeb2a5a3d496d2540b232c023a41f4f1b3f610e4dd9d8f037688ac238f252a654cce80040a5c3f6d04942893aa43ffb2fca176f84a643e67e06f85cc36e12
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwq

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4180	explorer.exe
4112	explorer.exe
2716	spoolsv.exe
3480	spoolsv.exe
4008	spoolsv.exe
4684	spoolsv.exe
4460	spoolsv.exe
3472	spoolsv.exe
1860	spoolsv.exe
3632	spoolsv.exe
4616	spoolsv.exe
4368	spoolsv.exe
2456	spoolsv.exe
3328	spoolsv.exe
4748	spoolsv.exe
5108	spoolsv.exe
3744	spoolsv.exe
3196	spoolsv.exe
2364	spoolsv.exe
232	spoolsv.exe
4392	spoolsv.exe
3148	spoolsv.exe
2404	spoolsv.exe
1328	spoolsv.exe
5068	spoolsv.exe
4716	spoolsv.exe
4416	spoolsv.exe
1084	spoolsv.exe
4612	spoolsv.exe
4968	spoolsv.exe
2504	spoolsv.exe
4012	spoolsv.exe
972	spoolsv.exe
4344	explorer.exe
4136	spoolsv.exe
3732	spoolsv.exe
1440	spoolsv.exe
2016	spoolsv.exe
4356	spoolsv.exe
5104	spoolsv.exe
4744	explorer.exe
5028	spoolsv.exe
1196	spoolsv.exe
3144	spoolsv.exe
1604	spoolsv.exe
1764	spoolsv.exe
2552	spoolsv.exe
3676	spoolsv.exe
3388	explorer.exe
1640	spoolsv.exe
4400	spoolsv.exe
3672	spoolsv.exe
4496	spoolsv.exe
3156	explorer.exe
4512	spoolsv.exe
4688	spoolsv.exe
3264	spoolsv.exe
4816	spoolsv.exe
4240	spoolsv.exe
4988	spoolsv.exe
4540	explorer.exe
3080	spoolsv.exe
1616	spoolsv.exe
3952	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 50 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4180 set thread context of 4112	4180	explorer.exe	102
PID 2716 set thread context of 972	2716	spoolsv.exe	137
PID 3480 set thread context of 4136	3480	spoolsv.exe	139
PID 4008 set thread context of 3732	4008	spoolsv.exe	140
PID 4684 set thread context of 2016	4684	spoolsv.exe	142
PID 4460 set thread context of 4356	4460	spoolsv.exe	143
PID 3472 set thread context of 5104	3472	spoolsv.exe	144
PID 1860 set thread context of 5028	1860	spoolsv.exe	146
PID 3632 set thread context of 1196	3632	spoolsv.exe	147
PID 4616 set thread context of 3144	4616	spoolsv.exe	148
PID 4368 set thread context of 1764	4368	spoolsv.exe	150
PID 2456 set thread context of 2552	2456	spoolsv.exe	151
PID 3328 set thread context of 3676	3328	spoolsv.exe	152
PID 4748 set thread context of 1640	4748	spoolsv.exe	154
PID 5108 set thread context of 3672	5108	spoolsv.exe	156
PID 3744 set thread context of 4496	3744	spoolsv.exe	157
PID 3196 set thread context of 4512	3196	spoolsv.exe	159
PID 2364 set thread context of 4688	2364	spoolsv.exe	160
PID 232 set thread context of 3264	232	spoolsv.exe	161
PID 4392 set thread context of 4816	4392	spoolsv.exe	163
PID 3148 set thread context of 4988	3148	spoolsv.exe	165
PID 2404 set thread context of 3080	2404	spoolsv.exe	167
PID 1328 set thread context of 1616	1328	spoolsv.exe	168
PID 5068 set thread context of 3952	5068	spoolsv.exe	169
PID 4716 set thread context of 4916	4716	spoolsv.exe	171
PID 4416 set thread context of 440	4416	spoolsv.exe	173
PID 1084 set thread context of 4468	1084	spoolsv.exe	174
PID 4612 set thread context of 2216	4612	spoolsv.exe	175
PID 4968 set thread context of 2340	4968	spoolsv.exe	177
PID 2504 set thread context of 2036	2504	spoolsv.exe	178
PID 4012 set thread context of 1920	4012	spoolsv.exe	184
PID 4344 set thread context of 3920	4344	explorer.exe	188
PID 1440 set thread context of 1296	1440	spoolsv.exe	194
PID 4744 set thread context of 516	4744	explorer.exe	197
PID 1604 set thread context of 1536	1604	spoolsv.exe	200
PID 3388 set thread context of 3316	3388	explorer.exe	204
PID 4400 set thread context of 2020	4400	spoolsv.exe	211
PID 3156 set thread context of 2156	3156	explorer.exe	213
PID 4240 set thread context of 5032	4240	spoolsv.exe	217
PID 4540 set thread context of 4360	4540	explorer.exe	219
PID 2184 set thread context of 5024	2184	spoolsv.exe	222
PID 4040 set thread context of 4396	4040	explorer.exe	224
PID 4960 set thread context of 4296	4960	spoolsv.exe	225
PID 4148 set thread context of 3324	4148	explorer.exe	226
PID 760 set thread context of 1792	760	spoolsv.exe	227
PID 2908 set thread context of 4088	2908	spoolsv.exe	228
PID 3400 set thread context of 5336	3400	spoolsv.exe	230
PID 640 set thread context of 5416	640	explorer.exe	232
PID 1028 set thread context of 5504	1028	spoolsv.exe	233

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4112	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
4112	explorer.exe
972	spoolsv.exe
972	spoolsv.exe
4136	spoolsv.exe
4136	spoolsv.exe
3732	spoolsv.exe
3732	spoolsv.exe
2016	spoolsv.exe
2016	spoolsv.exe
4356	spoolsv.exe
4356	spoolsv.exe
5104	spoolsv.exe
5104	spoolsv.exe
5028	spoolsv.exe
5028	spoolsv.exe
1196	spoolsv.exe
1196	spoolsv.exe
3144	spoolsv.exe
3144	spoolsv.exe
1764	spoolsv.exe
1764	spoolsv.exe
2552	spoolsv.exe
2552	spoolsv.exe
3676	spoolsv.exe
3676	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
3672	spoolsv.exe
3672	spoolsv.exe
4496	spoolsv.exe
4496	spoolsv.exe
4512	spoolsv.exe
4512	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
3264	spoolsv.exe
3264	spoolsv.exe
4816	spoolsv.exe
4816	spoolsv.exe
4988	spoolsv.exe
4988	spoolsv.exe
3080	spoolsv.exe
3080	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
3952	spoolsv.exe
3952	spoolsv.exe
4916	spoolsv.exe
4916	spoolsv.exe
440	spoolsv.exe
440	spoolsv.exe
4468	spoolsv.exe
4468	spoolsv.exe
2216	spoolsv.exe
2216	spoolsv.exe
2340	spoolsv.exe
2340	spoolsv.exe
2036	spoolsv.exe
2036	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1464	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	84
PID 4924 wrote to memory of 1464	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	84
PID 4924 wrote to memory of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4924 wrote to memory of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4924 wrote to memory of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4924 wrote to memory of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4924 wrote to memory of 4160	4924	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	98
PID 4160 wrote to memory of 4180	4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	99
PID 4160 wrote to memory of 4180	4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	99
PID 4160 wrote to memory of 4180	4160	176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe	99
PID 4180 wrote to memory of 4112	4180	explorer.exe	102
PID 4180 wrote to memory of 4112	4180	explorer.exe	102
PID 4180 wrote to memory of 4112	4180	explorer.exe	102
PID 4180 wrote to memory of 4112	4180	explorer.exe	102
PID 4180 wrote to memory of 4112	4180	explorer.exe	102
PID 4112 wrote to memory of 2716	4112	explorer.exe	103
PID 4112 wrote to memory of 2716	4112	explorer.exe	103
PID 4112 wrote to memory of 2716	4112	explorer.exe	103
PID 4112 wrote to memory of 3480	4112	explorer.exe	104
PID 4112 wrote to memory of 3480	4112	explorer.exe	104
PID 4112 wrote to memory of 3480	4112	explorer.exe	104
PID 4112 wrote to memory of 4008	4112	explorer.exe	105
PID 4112 wrote to memory of 4008	4112	explorer.exe	105
PID 4112 wrote to memory of 4008	4112	explorer.exe	105
PID 4112 wrote to memory of 4684	4112	explorer.exe	106
PID 4112 wrote to memory of 4684	4112	explorer.exe	106
PID 4112 wrote to memory of 4684	4112	explorer.exe	106
PID 4112 wrote to memory of 4460	4112	explorer.exe	107
PID 4112 wrote to memory of 4460	4112	explorer.exe	107
PID 4112 wrote to memory of 4460	4112	explorer.exe	107
PID 4112 wrote to memory of 3472	4112	explorer.exe	108
PID 4112 wrote to memory of 3472	4112	explorer.exe	108
PID 4112 wrote to memory of 3472	4112	explorer.exe	108
PID 4112 wrote to memory of 1860	4112	explorer.exe	109
PID 4112 wrote to memory of 1860	4112	explorer.exe	109
PID 4112 wrote to memory of 1860	4112	explorer.exe	109
PID 4112 wrote to memory of 3632	4112	explorer.exe	110
PID 4112 wrote to memory of 3632	4112	explorer.exe	110
PID 4112 wrote to memory of 3632	4112	explorer.exe	110
PID 4112 wrote to memory of 4616	4112	explorer.exe	111
PID 4112 wrote to memory of 4616	4112	explorer.exe	111
PID 4112 wrote to memory of 4616	4112	explorer.exe	111
PID 4112 wrote to memory of 4368	4112	explorer.exe	112
PID 4112 wrote to memory of 4368	4112	explorer.exe	112
PID 4112 wrote to memory of 4368	4112	explorer.exe	112
PID 4112 wrote to memory of 2456	4112	explorer.exe	114
PID 4112 wrote to memory of 2456	4112	explorer.exe	114
PID 4112 wrote to memory of 2456	4112	explorer.exe	114
PID 4112 wrote to memory of 3328	4112	explorer.exe	116
PID 4112 wrote to memory of 3328	4112	explorer.exe	116
PID 4112 wrote to memory of 3328	4112	explorer.exe	116
PID 4112 wrote to memory of 4748	4112	explorer.exe	117
PID 4112 wrote to memory of 4748	4112	explorer.exe	117
PID 4112 wrote to memory of 4748	4112	explorer.exe	117
PID 4112 wrote to memory of 5108	4112	explorer.exe	120
PID 4112 wrote to memory of 5108	4112	explorer.exe	120
PID 4112 wrote to memory of 5108	4112	explorer.exe	120
PID 4112 wrote to memory of 3744	4112	explorer.exe	121
PID 4112 wrote to memory of 3744	4112	explorer.exe	121
PID 4112 wrote to memory of 3744	4112	explorer.exe	121
PID 4112 wrote to memory of 3196	4112	explorer.exe	122
PID 4112 wrote to memory of 3196	4112	explorer.exe	122
PID 4112 wrote to memory of 3196	4112	explorer.exe	122
PID 4112 wrote to memory of 2364	4112	explorer.exe	123

C:\Users\Admin\AppData\Local\Temp\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\176a5933985418f3a5cbefb3012e9069_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4344
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5104
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4744
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3156
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4916
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4040
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4148
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1296
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3760
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5032
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6112
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
6fc642b11cd2f767db88e6d1ff0532ff

SHA1
80941c7ed91d0c97b9d243031722ab0d4faab9e4

SHA256
bf7ecfa81feb72027cf2d48efd4d6bbbb857b57badf29deeb2af8faab52a78fd

SHA512
c3c5d163a39e8ddfd7d9ae29c479ea5b11d1dd710c853441489d2924b5e450c75ff8e54af8eef8cea2fd27410df5e294264fe791279ce70529d0510cf290e789

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
6890bc1e01e0c1234815a9b5f152b0aa

SHA1
e084609a588f1f2624f2d010e67733d567a7229a

SHA256
29c30c88253e7c3b62846b0244e0212ee298b976d23b0b680f9fca7d4225aa18

SHA512
c21d032da92be7a80ffb6156d0d74287d25d93666a17412648fe7ded5bbd5e4f41c15448990a4d0c51188bf3cb4529337e228b54bbb002f4656b7a023fbfd746

Download Submit
memory/232-1855-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/440-2834-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/516-3797-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/972-2090-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/972-1945-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1196-2125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1296-3776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1328-1967-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1536-3864-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1536-3982-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-2651-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-2654-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1640-2318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1764-2212-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-4735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-1307-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1920-3370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-3247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-2041-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2020-4262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2036-3014-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2036-3132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2156-4270-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-2856-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2340-2963-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2364-1854-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2404-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2456-1503-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-831-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-1946-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3080-2644-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3080-2642-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3144-2136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3148-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3196-1853-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3264-2462-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-4057-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3324-4727-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3328-1504-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3472-1166-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3480-1957-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3480-1002-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3632-1308-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3672-2379-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3732-1968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3744-1680-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-3442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3952-2673-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4008-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4008-1003-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4088-4746-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4112-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4112-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4112-830-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4136-1956-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4136-1953-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4160-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4180-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4180-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4356-2072-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4360-4548-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-1502-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4392-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4460-1165-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4496-2429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-2444-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-2439-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-1309-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-1004-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-2037-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4748-1678-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4816-2479-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4924-0-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4924-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4924-28-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4924-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4988-2778-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-2633-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-4696-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-4845-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-2116-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-4606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-4537-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5104-2271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5108-1679-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5336-4869-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5416-4878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5504-4886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5540-5296-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5568-4897-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5800-5154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5800-5267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5948-5165-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6016-5174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6112-5016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download