pony | 90644041e0683f6ff3f60f7004531bd6e2eac33e5e9bc7fe53630d76dfe3cc58

General

Target

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
Size

2.2MB
MD5

63cff513d52c8bd5e9f413e8524abb61
SHA1

89c2c9093df991951df3b584e1e54de54570f3fe
SHA256

90644041e0683f6ff3f60f7004531bd6e2eac33e5e9bc7fe53630d76dfe3cc58
SHA512

4025bf808d7ce2d324c2128792da855b0b68a9a064f79c075e404daf793736da89c6704faa23469122cc2c1b387c8f890db2f90a7c436b35560ea0447a33def7
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwV

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2688	explorer.exe
1608	explorer.exe
1844	spoolsv.exe
1776	spoolsv.exe
2288	spoolsv.exe
580	spoolsv.exe
1044	spoolsv.exe
1748	spoolsv.exe
2180	spoolsv.exe
2596	spoolsv.exe
2780	spoolsv.exe
1184	spoolsv.exe
2156	spoolsv.exe
1856	spoolsv.exe
1740	spoolsv.exe
1656	spoolsv.exe
3048	spoolsv.exe
2644	spoolsv.exe
2344	spoolsv.exe
1292	spoolsv.exe
2052	spoolsv.exe
572	spoolsv.exe
1928	spoolsv.exe
1364	spoolsv.exe
2132	spoolsv.exe
2524	spoolsv.exe
2436	spoolsv.exe
2248	spoolsv.exe
1104	spoolsv.exe
1100	spoolsv.exe
2032	spoolsv.exe
2868	spoolsv.exe
1412	spoolsv.exe
1320	spoolsv.exe
560	spoolsv.exe
952	spoolsv.exe
2220	spoolsv.exe
2636	spoolsv.exe
2432	spoolsv.exe
2880	spoolsv.exe
1984	spoolsv.exe
1924	spoolsv.exe
2812	spoolsv.exe
2568	spoolsv.exe
320	spoolsv.exe
352	spoolsv.exe
3000	spoolsv.exe
1296	spoolsv.exe
1760	spoolsv.exe
2408	spoolsv.exe
1056	spoolsv.exe
2332	spoolsv.exe
996	spoolsv.exe
1552	spoolsv.exe
2200	spoolsv.exe
2376	spoolsv.exe
2124	spoolsv.exe
2336	spoolsv.exe
3060	spoolsv.exe
2732	spoolsv.exe
2276	spoolsv.exe
1688	spoolsv.exe
1556	spoolsv.exe
1060	spoolsv.exe

Loads dropped DLL 64 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exeexplorer.exe

pid	process
2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2716 set thread context of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2688 set thread context of 1608	2688	explorer.exe	explorer.exe

Drops file in Windows directory 64 IoCs

Processes:

spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exeexplorer.exe

pid	process
2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1608 explorer.exe

pid	process
1608	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exeexplorer.exe

pid	process
2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe
1608	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 2716 wrote to memory of 2120	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	splwow64.exe
PID 2716 wrote to memory of 2120	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	splwow64.exe
PID 2716 wrote to memory of 2120	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	splwow64.exe
PID 2716 wrote to memory of 2120	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	splwow64.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2716 wrote to memory of 2360	2716	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
PID 2360 wrote to memory of 2688	2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	explorer.exe
PID 2360 wrote to memory of 2688	2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	explorer.exe
PID 2360 wrote to memory of 2688	2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	explorer.exe
PID 2360 wrote to memory of 2688	2360	63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 2688 wrote to memory of 1608	2688	explorer.exe	explorer.exe
PID 1608 wrote to memory of 1844	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1844	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1844	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1844	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1776	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1776	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1776	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1776	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2288	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2288	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2288	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2288	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 580	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 580	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 580	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 580	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1044	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1044	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1044	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1044	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1748	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1748	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1748	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1748	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2180	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2180	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2180	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2180	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2596	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2596	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2596	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2596	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2780	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2780	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2780	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2780	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1184	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1184	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1184	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 1184	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2156	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2156	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2156	1608	explorer.exe	spoolsv.exe
PID 1608 wrote to memory of 2156	1608	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1844

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4460

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1776

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4364

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:4440

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:580

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4252

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1044

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5344

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1748

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2180

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2596

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6664

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2780

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1184

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6724

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2156

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1740

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6872

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:3048

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2344

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1292

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2052

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1928

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1364

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2248

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1104

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1100

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2032

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1412

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1320

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:560

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:952

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2220

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2636

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2432

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1984

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2812

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2568

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:320

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:352

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3000

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1760

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1056

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2332

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:996

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2200

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2376

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2124

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2336

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:3060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2732

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1688

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1556

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1248

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2460

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1140

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2424

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2580

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:556

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:2860

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2576

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2532

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:1712

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:844

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:1828

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3112

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3272

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3432

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3592

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3908

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4068

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3208

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:1960

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3612

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3792

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3972

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3120

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3248

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3472

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3700

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2140

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3376

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3580

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3836

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4076

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3132

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3476

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3760

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4032

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3164

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3528

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3796

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3096

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3360

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3688

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3312

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3728

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3128

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3508

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3920

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2176

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3368

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4016

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3656

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3416

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3768

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3724

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3884

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3428

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3772

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3136

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4224

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4384

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4544

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4756

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4912

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:5068

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4208

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4392

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4568

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4728

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4936

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3860

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4300

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4500

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4704

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4908

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4104

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:6392

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\Parameters.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\system\explorer.exe
Filesize
2.2MB

MD5
dfd2140e221be00366b393749b65f3ec

SHA1
a345006e54ba53a587db99a56ae361d126d09096

SHA256
12d924225da7277436623b466400067f08e762392162105625c6a520eb574e5b

SHA512
0cf343c3179f33ba52bf32567427d936d16fed4162f90515bf4a342ee11066cb4602a958f0d3ccb767685c078a25e0b7a2f3ccd334262b97d037d4fd246214d4

Download Submit
\Windows\system\spoolsv.exe
Filesize
2.2MB

MD5
f0d5ac72a1766363064657ab0910d59e

SHA1
ed7c8f0033d3cb7efe49386f3f10530b1f6a9bf1

SHA256
d688c731cadcc298aecf86b26fedbb49cef59a50fabb525aaf115292a6d07066

SHA512
4b036118e9d95feaeb55df8553b1de7e92c64aadbfa58cc37d80ac7b9aad817071d8982b7b8d8c5aa82c5db3ef9ac3a4c8fb0f2fac8d9a1b007d4325257a11f7

Download Submit
memory/572-3289-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/580-2397-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1044-2398-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1100-3297-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1104-3296-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1184-2921-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1292-2941-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1364-3291-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1608-2393-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-2928-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1740-2927-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1748-2915-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1776-2395-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1844-2394-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1856-2926-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1928-3290-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2032-3298-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2052-2942-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2132-3292-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2156-2925-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2180-2916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2248-3295-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2288-2396-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2344-2940-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2360-28-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2360-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2436-3294-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2524-3293-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-2918-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2644-2930-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2688-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2688-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2688-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-17-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2716-19-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2716-29-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2780-2920-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2868-3299-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3048-2929-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4252-5220-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4364-5195-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4460-5207-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5344-5344-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6172-5363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads