pony | 7cdde7d87bdcbd0df68adc069cc715605684820ee81de9de18ae484bf8cef64d

Analysis

max time kernel
134s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
Size

2.2MB
MD5

6898c5bee8ef280f4965fe93cdf3324e
SHA1

23fd34da9421820cec01cdd8a09358bac491993b
SHA256

7cdde7d87bdcbd0df68adc069cc715605684820ee81de9de18ae484bf8cef64d
SHA512

12924b3a54fa614f195ae8b6747270c3b47cf4861274bd01ced9e52c3a0047e2f1b0b4e7fa020d8737e77a753b6858a6ae2076cf8340e8ca77af6a48602217ed
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWww9

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2240	explorer.exe
4624	explorer.exe
540	spoolsv.exe
3164	spoolsv.exe
4648	spoolsv.exe
956	spoolsv.exe
2032	spoolsv.exe
1548	spoolsv.exe
364	spoolsv.exe
2900	spoolsv.exe
1480	spoolsv.exe
740	spoolsv.exe
1008	spoolsv.exe
4400	spoolsv.exe
320	spoolsv.exe
2792	spoolsv.exe
4684	spoolsv.exe
1144	spoolsv.exe
4120	spoolsv.exe
3396	spoolsv.exe
3640	spoolsv.exe
4580	spoolsv.exe
1280	spoolsv.exe
5080	spoolsv.exe
2692	spoolsv.exe
3316	spoolsv.exe
5224	spoolsv.exe
5588	spoolsv.exe
5912	spoolsv.exe
5180	spoolsv.exe
5540	spoolsv.exe
5648	spoolsv.exe
5704	explorer.exe
5848	spoolsv.exe
5768	spoolsv.exe
5244	spoolsv.exe
5256	spoolsv.exe
5420	spoolsv.exe
2424	spoolsv.exe
5964	explorer.exe
6044	spoolsv.exe
6084	spoolsv.exe
3552	spoolsv.exe
5536	spoolsv.exe
876	spoolsv.exe
1816	spoolsv.exe
6016	explorer.exe
6136	spoolsv.exe
3028	spoolsv.exe
5504	spoolsv.exe
2708	spoolsv.exe
660	spoolsv.exe
832	explorer.exe
6104	spoolsv.exe
3364	spoolsv.exe
3740	spoolsv.exe
5252	spoolsv.exe
5396	spoolsv.exe
4676	spoolsv.exe
4808	explorer.exe
228	spoolsv.exe
4544	spoolsv.exe
2240	spoolsv.exe
6116	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 40 IoCs

Processes:

6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exe

description	pid	process	target process
PID 4180 set thread context of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 2240 set thread context of 4624	2240	explorer.exe	explorer.exe
PID 540 set thread context of 5648	540	spoolsv.exe	spoolsv.exe
PID 3164 set thread context of 5848	3164	spoolsv.exe	spoolsv.exe
PID 4648 set thread context of 5768	4648	spoolsv.exe	spoolsv.exe
PID 956 set thread context of 5256	956	spoolsv.exe	spoolsv.exe
PID 2032 set thread context of 5420	2032	spoolsv.exe	spoolsv.exe
PID 1548 set thread context of 2424	1548	spoolsv.exe	spoolsv.exe
PID 364 set thread context of 6044	364	spoolsv.exe	spoolsv.exe
PID 2900 set thread context of 6084	2900	spoolsv.exe	spoolsv.exe
PID 1480 set thread context of 3552	1480	spoolsv.exe	spoolsv.exe
PID 740 set thread context of 5536	740	spoolsv.exe	spoolsv.exe
PID 1008 set thread context of 1816	1008	spoolsv.exe	spoolsv.exe
PID 4400 set thread context of 6136	4400	spoolsv.exe	spoolsv.exe
PID 320 set thread context of 3028	320	spoolsv.exe	spoolsv.exe
PID 2792 set thread context of 5504	2792	spoolsv.exe	spoolsv.exe
PID 4684 set thread context of 660	4684	spoolsv.exe	spoolsv.exe
PID 1144 set thread context of 6104	1144	spoolsv.exe	spoolsv.exe
PID 4120 set thread context of 3364	4120	spoolsv.exe	spoolsv.exe
PID 3396 set thread context of 3740	3396	spoolsv.exe	spoolsv.exe
PID 3640 set thread context of 5396	3640	spoolsv.exe	spoolsv.exe
PID 4580 set thread context of 4676	4580	spoolsv.exe	spoolsv.exe
PID 1280 set thread context of 228	1280	spoolsv.exe	spoolsv.exe
PID 5080 set thread context of 4544	5080	spoolsv.exe	spoolsv.exe
PID 2692 set thread context of 6116	2692	spoolsv.exe	spoolsv.exe
PID 3316 set thread context of 4424	3316	spoolsv.exe	spoolsv.exe
PID 5224 set thread context of 5800	5224	spoolsv.exe	spoolsv.exe
PID 5588 set thread context of 2352	5588	spoolsv.exe	spoolsv.exe
PID 5912 set thread context of 1184	5912	spoolsv.exe	spoolsv.exe
PID 5180 set thread context of 5520	5180	spoolsv.exe	spoolsv.exe
PID 5540 set thread context of 5188	5540	spoolsv.exe	spoolsv.exe
PID 5704 set thread context of 6012	5704	explorer.exe	explorer.exe
PID 5244 set thread context of 1080	5244	spoolsv.exe	spoolsv.exe
PID 5964 set thread context of 4944	5964	explorer.exe	explorer.exe
PID 876 set thread context of 4984	876	spoolsv.exe	spoolsv.exe
PID 6016 set thread context of 4940	6016	explorer.exe	explorer.exe
PID 2708 set thread context of 5176	2708	spoolsv.exe	spoolsv.exe
PID 832 set thread context of 2000	832	explorer.exe	explorer.exe
PID 5252 set thread context of 1704	5252	spoolsv.exe	spoolsv.exe
PID 4808 set thread context of 3032	4808	explorer.exe	explorer.exe

Drops file in Windows directory 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exe6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exeexplorer.exe

pid	process
1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

4624 explorer.exe

pid	process
4624	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

pid	process
1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
4624	explorer.exe
5648	spoolsv.exe
5648	spoolsv.exe
5848	spoolsv.exe
5848	spoolsv.exe
5768	spoolsv.exe
5768	spoolsv.exe
5256	spoolsv.exe
5256	spoolsv.exe
5420	spoolsv.exe
5420	spoolsv.exe
2424	spoolsv.exe
2424	spoolsv.exe
6044	spoolsv.exe
6044	spoolsv.exe
6084	spoolsv.exe
6084	spoolsv.exe
3552	spoolsv.exe
3552	spoolsv.exe
5536	spoolsv.exe
5536	spoolsv.exe
1816	spoolsv.exe
1816	spoolsv.exe
6136	spoolsv.exe
6136	spoolsv.exe
3028	spoolsv.exe
3028	spoolsv.exe
5504	spoolsv.exe
5504	spoolsv.exe
660	spoolsv.exe
660	spoolsv.exe
6104	spoolsv.exe
6104	spoolsv.exe
3364	spoolsv.exe
3364	spoolsv.exe
3740	spoolsv.exe
3740	spoolsv.exe
5396	spoolsv.exe
5396	spoolsv.exe
4676	spoolsv.exe
4676	spoolsv.exe
228	spoolsv.exe
228	spoolsv.exe
4544	spoolsv.exe
4544	spoolsv.exe
6116	spoolsv.exe
6116	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
5800	spoolsv.exe
5800	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
1184	spoolsv.exe
1184	spoolsv.exe
5520	spoolsv.exe
5520	spoolsv.exe
5188	spoolsv.exe
5188	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 4180 wrote to memory of 5028	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	splwow64.exe
PID 4180 wrote to memory of 5028	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	splwow64.exe
PID 4180 wrote to memory of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 4180 wrote to memory of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 4180 wrote to memory of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 4180 wrote to memory of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 4180 wrote to memory of 1912	4180	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
PID 1912 wrote to memory of 2240	1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	explorer.exe
PID 1912 wrote to memory of 2240	1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	explorer.exe
PID 1912 wrote to memory of 2240	1912	6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe	explorer.exe
PID 2240 wrote to memory of 4624	2240	explorer.exe	explorer.exe
PID 2240 wrote to memory of 4624	2240	explorer.exe	explorer.exe
PID 2240 wrote to memory of 4624	2240	explorer.exe	explorer.exe
PID 2240 wrote to memory of 4624	2240	explorer.exe	explorer.exe
PID 2240 wrote to memory of 4624	2240	explorer.exe	explorer.exe
PID 4624 wrote to memory of 540	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 540	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 540	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 3164	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 3164	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 3164	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4648	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4648	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4648	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 956	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 956	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 956	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2032	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2032	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2032	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1548	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1548	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1548	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 364	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 364	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 364	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2900	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2900	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2900	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1480	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1480	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1480	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 740	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 740	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 740	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1008	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1008	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1008	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4400	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4400	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4400	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 320	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 320	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 320	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2792	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2792	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 2792	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4684	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4684	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4684	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1144	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1144	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 1144	4624	explorer.exe	spoolsv.exe
PID 4624 wrote to memory of 4120	4624	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6898c5bee8ef280f4965fe93cdf3324e_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1912
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5964
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:660
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:832
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5188
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1080
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4472
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4984
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1704
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3204
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\Parameters.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
4496acfeb2e3afbbb3cad6756e0837c2

SHA1
70e4f76cf345d2356267074e9b3faa6edfb68900

SHA256
a9ecd8a464b565e3ba51d9a666b7913caf6f0334b4d8281fa4be55b34cdff454

SHA512
c48b12bf283f9543db677e18a50097c8410d71ca5965e592d257d44b6764907fcb4ad8ee543a4f9142fed250c4dcf579dcc616c13d5d5a70522ab16b7b906950

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
d3d1f2f85d660efad61141470c48dce2

SHA1
7132cc3d863ad7ce51da090455effec01d4b626c

SHA256
15083069852775e477a7de724df24c4a8091deb89c18964442ff5bbadf647610

SHA512
625b217b099de1ab3016de2448d0ee68e3b9bb1693d4e5cfff431b903c7d8cb5f743094843945ea158140d52b2b387cb7544f6d7e5f2330e4fcae8d5bb8eaff3

Download Submit
memory/212-4910-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/212-4908-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/228-2753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/320-1678-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/364-1367-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/540-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/540-861-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/660-2573-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/660-2726-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/740-1537-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/956-2087-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/956-994-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-1538-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1080-3762-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1080-3886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1144-1888-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1184-3027-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-3022-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1280-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1480-1369-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1548-1176-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1704-4476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-4581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-5197-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1804-4769-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1816-2400-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1816-2550-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1912-90-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1912-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1912-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-4332-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2032-1175-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2352-3007-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2352-3017-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2424-2376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2424-2191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-1679-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2900-1368-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3028-2420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3032-4549-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3164-992-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3164-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3204-4807-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3204-4985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-2593-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3396-1967-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3552-2220-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3640-1968-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4120-1889-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4180-0-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/4180-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4180-48-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/4180-53-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4400-1539-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4412-4626-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-3084-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4544-2762-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4544-2766-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-5207-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4580-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4624-646-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4624-100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-1993-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4648-993-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4676-2744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4676-2894-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4684-1887-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4940-4050-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4944-3773-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4984-4147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4984-4040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5072-4873-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5072-4825-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-2085-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5176-4389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5188-3581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5188-3455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5256-2086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5388-4737-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5396-2668-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5420-2097-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5504-2498-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5504-2507-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5520-3205-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5520-3101-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5536-2295-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5552-4726-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5648-2147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5648-1969-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5692-5166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5768-1989-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5800-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5848-1979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5848-1980-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/6012-3550-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6036-5188-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6044-2202-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6044-2198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6084-2213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6104-2582-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6116-2847-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6136-2409-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download