pony | d4038474f036f37854e45d395313b9f5a14655189ecdd57ef4156cbcc7af43dc

Analysis

max time kernel
131s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
Size

2.2MB
MD5

6b8ecc6e0ebeeed7be7fb545be0a98e1
SHA1

2392de2f5206e6b88ed3eaa346e1dcd70c14a229
SHA256

d4038474f036f37854e45d395313b9f5a14655189ecdd57ef4156cbcc7af43dc
SHA512

25d9f8f8bb702537095f7634e1037304643a6b2af67a58c9185a59f669f512ce818dc4f4fc96e9db729df05b0f7967eec4874915090e91293b8d61e11cea1557
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwY

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

Processes:

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe

pid	process
5000	explorer.exe
3204	explorer.exe
556	spoolsv.exe
4784	spoolsv.exe
1548	spoolsv.exe
4364	spoolsv.exe
3136	spoolsv.exe
4944	spoolsv.exe
1712	spoolsv.exe
64	spoolsv.exe
624	spoolsv.exe
4428	spoolsv.exe
1132	spoolsv.exe
1404	spoolsv.exe
2724	spoolsv.exe
4220	spoolsv.exe
3412	spoolsv.exe
4276	spoolsv.exe
3480	spoolsv.exe
3836	spoolsv.exe
1084	spoolsv.exe
4488	spoolsv.exe
2392	spoolsv.exe
3008	spoolsv.exe
4312	spoolsv.exe
1656	spoolsv.exe
4812	spoolsv.exe
1060	spoolsv.exe
4288	spoolsv.exe
2936	spoolsv.exe
4064	spoolsv.exe
3624	spoolsv.exe
2568	spoolsv.exe
944	explorer.exe
2280	spoolsv.exe
4384	spoolsv.exe
3560	spoolsv.exe
5064	spoolsv.exe
1768	spoolsv.exe
3112	explorer.exe
2224	spoolsv.exe
1824	spoolsv.exe
1852	spoolsv.exe
3600	spoolsv.exe
4808	spoolsv.exe
3484	spoolsv.exe
2428	spoolsv.exe
4916	spoolsv.exe
3488	spoolsv.exe
716	explorer.exe
4340	spoolsv.exe
4968	spoolsv.exe
4388	spoolsv.exe
1456	spoolsv.exe
4876	spoolsv.exe
3228	explorer.exe
4484	spoolsv.exe
5040	spoolsv.exe
2504	spoolsv.exe
2920	spoolsv.exe
2452	spoolsv.exe
1928	spoolsv.exe
436	spoolsv.exe
4852	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 39 IoCs

Processes:

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 4940 set thread context of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 5000 set thread context of 3204	5000	explorer.exe	explorer.exe
PID 556 set thread context of 2568	556	spoolsv.exe	spoolsv.exe
PID 4784 set thread context of 2280	4784	spoolsv.exe	spoolsv.exe
PID 1548 set thread context of 4384	1548	spoolsv.exe	spoolsv.exe
PID 4364 set thread context of 3560	4364	spoolsv.exe	spoolsv.exe
PID 3136 set thread context of 1768	3136	spoolsv.exe	spoolsv.exe
PID 4944 set thread context of 2224	4944	spoolsv.exe	spoolsv.exe
PID 1712 set thread context of 1824	1712	spoolsv.exe	spoolsv.exe
PID 64 set thread context of 1852	64	spoolsv.exe	spoolsv.exe
PID 624 set thread context of 3600	624	spoolsv.exe	spoolsv.exe
PID 4428 set thread context of 4808	4428	spoolsv.exe	spoolsv.exe
PID 1132 set thread context of 3484	1132	spoolsv.exe	spoolsv.exe
PID 1404 set thread context of 4916	1404	spoolsv.exe	spoolsv.exe
PID 2724 set thread context of 3488	2724	spoolsv.exe	spoolsv.exe
PID 4220 set thread context of 4340	4220	spoolsv.exe	spoolsv.exe
PID 3412 set thread context of 4388	3412	spoolsv.exe	spoolsv.exe
PID 4276 set thread context of 1456	4276	spoolsv.exe	spoolsv.exe
PID 3480 set thread context of 4876	3480	spoolsv.exe	spoolsv.exe
PID 3836 set thread context of 5040	3836	spoolsv.exe	spoolsv.exe
PID 1084 set thread context of 2504	1084	spoolsv.exe	spoolsv.exe
PID 4488 set thread context of 2920	4488	spoolsv.exe	spoolsv.exe
PID 2392 set thread context of 2452	2392	spoolsv.exe	spoolsv.exe
PID 3008 set thread context of 436	3008	spoolsv.exe	spoolsv.exe
PID 4312 set thread context of 2524	4312	spoolsv.exe	spoolsv.exe
PID 1656 set thread context of 3932	1656	spoolsv.exe	spoolsv.exe
PID 4812 set thread context of 4860	4812	spoolsv.exe	spoolsv.exe
PID 1060 set thread context of 4680	1060	spoolsv.exe	spoolsv.exe
PID 4288 set thread context of 5076	4288	spoolsv.exe	spoolsv.exe
PID 2936 set thread context of 1360	2936	spoolsv.exe	spoolsv.exe
PID 4064 set thread context of 5024	4064	spoolsv.exe	spoolsv.exe
PID 944 set thread context of 2748	944	explorer.exe	explorer.exe
PID 3624 set thread context of 4280	3624	spoolsv.exe	spoolsv.exe
PID 3112 set thread context of 2964	3112	explorer.exe	explorer.exe
PID 2428 set thread context of 3520	2428	spoolsv.exe	spoolsv.exe
PID 716 set thread context of 3076	716	explorer.exe	explorer.exe
PID 4968 set thread context of 3756	4968	spoolsv.exe	spoolsv.exe
PID 3228 set thread context of 3432	3228	explorer.exe	explorer.exe
PID 4484 set thread context of 4076	4484	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 64 IoCs

Processes:

spoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exeexplorer.exe

pid	process
4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3204 explorer.exe

pid	process
3204	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

pid	process
4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
3204	explorer.exe
2568	spoolsv.exe
2568	spoolsv.exe
2280	spoolsv.exe
2280	spoolsv.exe
4384	spoolsv.exe
4384	spoolsv.exe
3560	spoolsv.exe
3560	spoolsv.exe
1768	spoolsv.exe
1768	spoolsv.exe
2224	spoolsv.exe
2224	spoolsv.exe
1824	spoolsv.exe
1824	spoolsv.exe
1852	spoolsv.exe
1852	spoolsv.exe
3600	spoolsv.exe
3600	spoolsv.exe
4808	spoolsv.exe
4808	spoolsv.exe
3484	spoolsv.exe
3484	spoolsv.exe
4916	spoolsv.exe
4916	spoolsv.exe
3488	spoolsv.exe
3488	spoolsv.exe
4340	spoolsv.exe
4340	spoolsv.exe
4388	spoolsv.exe
4388	spoolsv.exe
1456	spoolsv.exe
1456	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
5040	spoolsv.exe
5040	spoolsv.exe
2504	spoolsv.exe
2504	spoolsv.exe
2920	spoolsv.exe
2920	spoolsv.exe
2452	spoolsv.exe
2452	spoolsv.exe
436	spoolsv.exe
436	spoolsv.exe
2524	spoolsv.exe
2524	spoolsv.exe
3932	spoolsv.exe
3932	spoolsv.exe
4860	spoolsv.exe
4860	spoolsv.exe
4680	spoolsv.exe
4680	spoolsv.exe
5076	spoolsv.exe
5076	spoolsv.exe
1360	spoolsv.exe
1360	spoolsv.exe
5024	spoolsv.exe
5024	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 4940 wrote to memory of 4336	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	splwow64.exe
PID 4940 wrote to memory of 4336	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	splwow64.exe
PID 4940 wrote to memory of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 4940 wrote to memory of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 4940 wrote to memory of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 4940 wrote to memory of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 4940 wrote to memory of 4476	4940	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
PID 4476 wrote to memory of 5000	4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	explorer.exe
PID 4476 wrote to memory of 5000	4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	explorer.exe
PID 4476 wrote to memory of 5000	4476	6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe	explorer.exe
PID 5000 wrote to memory of 3204	5000	explorer.exe	explorer.exe
PID 5000 wrote to memory of 3204	5000	explorer.exe	explorer.exe
PID 5000 wrote to memory of 3204	5000	explorer.exe	explorer.exe
PID 5000 wrote to memory of 3204	5000	explorer.exe	explorer.exe
PID 5000 wrote to memory of 3204	5000	explorer.exe	explorer.exe
PID 3204 wrote to memory of 556	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 556	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 556	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4784	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4784	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4784	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1548	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1548	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1548	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4364	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4364	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4364	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3136	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3136	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3136	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4944	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4944	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4944	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1712	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1712	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1712	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 64	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 64	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 64	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 624	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 624	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 624	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4428	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4428	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4428	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1132	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1132	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1132	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1404	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1404	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 1404	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 2724	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 2724	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 2724	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4220	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4220	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4220	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3412	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3412	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3412	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4276	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4276	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 4276	3204	explorer.exe	spoolsv.exe
PID 3204 wrote to memory of 3480	3204	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4476
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:944
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:716
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:4852
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3356
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4280
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4440
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4716
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6012
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\Parameters.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
9bbd2bfc687fab43d4ab909b522feb3c

SHA1
7c905b62b42df212b04fa8d09f2ed39d52e280fc

SHA256
b8249b065bfc9c3db984b569e9362aecc39ebf2f9bdabefedc1f0341b1968eef

SHA512
112aed1c0e5a7fda2d1974e7bd4301610306511761bf151e225ae4564fd624caeb9d8817dad58361615cb295fb0d73bb5c0170005dea4b2b541548c78b6fe4ec

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
6c2b10a672ae4fda8b7dc41043a08550

SHA1
c9a3065d03b7f8d024bd480e5a66c6ccdeac05c3

SHA256
33b5173e9409998f734c60307abcf435ae142e22fcb679f70922b7d2484f4de7

SHA512
08e19b3803d81a30438d6f52e31ead961add4ce3dc6b8ee7040e4ac1f10b59469d609873f82abae147ba7effb34f0787d35591b8d76e7cb02da899750125f7fd

Download Submit
memory/64-1402-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/392-5086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/432-4744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-2879-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/556-1996-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/556-880-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/624-1403-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/956-5075-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/956-5078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1084-1993-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1132-1527-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1404-1528-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1456-2407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1456-2402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-2009-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1548-1017-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1712-1216-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1768-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-2166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1852-2178-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1852-2174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-2156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-2153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2280-2006-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2452-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2504-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-4735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2524-2745-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2568-2076-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2568-1995-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2724-1529-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2748-3357-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2964-3916-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3008-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3076-4171-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3076-4173-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-1214-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3204-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3204-686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3412-1739-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3432-4472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3480-1884-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3484-2208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-2465-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-2304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3520-4160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3520-4033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3560-2028-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3600-2186-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3756-4257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3756-4365-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3836-1885-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4076-4479-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-4592-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4220-1738-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4276-1883-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4280-3486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4340-2313-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4364-2024-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4364-1018-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4384-2017-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-2397-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-2392-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4428-1404-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4476-72-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4476-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4680-2824-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-1016-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4784-2003-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4808-2199-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-2767-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-2763-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4940-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4940-23-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/4940-0-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/4940-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4944-1215-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5000-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5000-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5024-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-2578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5076-2930-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5156-4980-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5160-5203-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5236-5211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5380-5060-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5576-4900-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5680-4911-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5720-5094-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5720-5099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5760-4929-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5868-4936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5936-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6012-5182-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6056-4965-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download