pony | 51cff0f4d239a5744ec11d9497ce87b387e96cd0fc089d040c2ea71bb5a31009

Analysis

max time kernel
127s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
Size

2.2MB
MD5

6f43490d501da4ae9e35a2e67ffe3049
SHA1

a229f4338856bad7af48d286300bedb7d62747ae
SHA256

51cff0f4d239a5744ec11d9497ce87b387e96cd0fc089d040c2ea71bb5a31009
SHA512

1bca948de55b5523e0fd69c507e71f2a90419ec09390cfa5d227254caf3d11112e454e53cb7eaf867654b90fe909e01ea24577505574b97e0a13a69c81a119e6
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWww9

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe

pid	process
4752	explorer.exe
60	explorer.exe
4012	spoolsv.exe
3748	spoolsv.exe
4068	spoolsv.exe
2228	spoolsv.exe
2872	spoolsv.exe
3644	spoolsv.exe
4828	spoolsv.exe
1364	spoolsv.exe
4668	spoolsv.exe
3576	spoolsv.exe
1756	spoolsv.exe
2060	spoolsv.exe
5028	spoolsv.exe
3220	spoolsv.exe
3380	spoolsv.exe
3512	spoolsv.exe
2732	spoolsv.exe
4760	spoolsv.exe
4172	spoolsv.exe
3148	spoolsv.exe
1788	spoolsv.exe
4136	spoolsv.exe
1988	spoolsv.exe
716	spoolsv.exe
2768	spoolsv.exe
3484	spoolsv.exe
3020	spoolsv.exe
3508	spoolsv.exe
4752	spoolsv.exe
1836	spoolsv.exe
972	explorer.exe
880	spoolsv.exe
4560	spoolsv.exe
3540	spoolsv.exe
4472	spoolsv.exe
1604	spoolsv.exe
1660	spoolsv.exe
3496	spoolsv.exe
4376	explorer.exe
536	spoolsv.exe
3524	spoolsv.exe
3180	spoolsv.exe
3752	spoolsv.exe
2720	spoolsv.exe
2688	spoolsv.exe
1100	explorer.exe
3176	spoolsv.exe
5112	spoolsv.exe
4224	spoolsv.exe
2852	explorer.exe
1356	spoolsv.exe
3752	spoolsv.exe
1536	spoolsv.exe
3828	spoolsv.exe
5072	explorer.exe
5084	spoolsv.exe
2892	spoolsv.exe
4464	spoolsv.exe
4684	spoolsv.exe
1252	spoolsv.exe
1980	spoolsv.exe
2504	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 38 IoCs

Processes:

6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exe

description	pid	process	target process
PID 4904 set thread context of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 4752 set thread context of 60	4752	explorer.exe	explorer.exe
PID 4012 set thread context of 1836	4012	spoolsv.exe	spoolsv.exe
PID 3748 set thread context of 880	3748	spoolsv.exe	spoolsv.exe
PID 4068 set thread context of 4560	4068	spoolsv.exe	spoolsv.exe
PID 2228 set thread context of 4472	2228	spoolsv.exe	spoolsv.exe
PID 2872 set thread context of 1604	2872	spoolsv.exe	spoolsv.exe
PID 3644 set thread context of 1660	3644	spoolsv.exe	spoolsv.exe
PID 4828 set thread context of 3496	4828	spoolsv.exe	spoolsv.exe
PID 1364 set thread context of 536	1364	spoolsv.exe	spoolsv.exe
PID 4668 set thread context of 3180	4668	spoolsv.exe	spoolsv.exe
PID 3576 set thread context of 3752	3576	spoolsv.exe	spoolsv.exe
PID 1756 set thread context of 2720	1756	spoolsv.exe	spoolsv.exe
PID 2060 set thread context of 2688	2060	spoolsv.exe	spoolsv.exe
PID 5028 set thread context of 3176	5028	spoolsv.exe	spoolsv.exe
PID 3220 set thread context of 4224	3220	spoolsv.exe	spoolsv.exe
PID 3380 set thread context of 1356	3380	spoolsv.exe	spoolsv.exe
PID 3512 set thread context of 3752	3512	spoolsv.exe	spoolsv.exe
PID 2732 set thread context of 3828	2732	spoolsv.exe	spoolsv.exe
PID 4760 set thread context of 5084	4760	spoolsv.exe	spoolsv.exe
PID 4172 set thread context of 2892	4172	spoolsv.exe	spoolsv.exe
PID 3148 set thread context of 4464	3148	spoolsv.exe	spoolsv.exe
PID 1788 set thread context of 1252	1788	spoolsv.exe	spoolsv.exe
PID 4136 set thread context of 1980	4136	spoolsv.exe	spoolsv.exe
PID 1988 set thread context of 312	1988	spoolsv.exe	spoolsv.exe
PID 716 set thread context of 4608	716	spoolsv.exe	spoolsv.exe
PID 2768 set thread context of 4680	2768	spoolsv.exe	spoolsv.exe
PID 3484 set thread context of 3628	3484	spoolsv.exe	spoolsv.exe
PID 3020 set thread context of 2292	3020	spoolsv.exe	spoolsv.exe
PID 3508 set thread context of 3192	3508	spoolsv.exe	spoolsv.exe
PID 4752 set thread context of 2936	4752	spoolsv.exe	spoolsv.exe
PID 972 set thread context of 4948	972	explorer.exe	explorer.exe
PID 3540 set thread context of 4484	3540	spoolsv.exe	spoolsv.exe
PID 4376 set thread context of 5260	4376	explorer.exe	explorer.exe
PID 3524 set thread context of 5656	3524	spoolsv.exe	spoolsv.exe
PID 1100 set thread context of 5820	1100	explorer.exe	explorer.exe
PID 5112 set thread context of 5532	5112	spoolsv.exe	spoolsv.exe
PID 2852 set thread context of 1400	2852	explorer.exe	explorer.exe

Drops file in Windows directory 64 IoCs

Processes:

spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exe

pid	process
2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

pid	process
2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
1836	spoolsv.exe
1836	spoolsv.exe
880	spoolsv.exe
880	spoolsv.exe
4560	spoolsv.exe
4560	spoolsv.exe
4472	spoolsv.exe
4472	spoolsv.exe
1604	spoolsv.exe
1604	spoolsv.exe
1660	spoolsv.exe
1660	spoolsv.exe
3496	spoolsv.exe
3496	spoolsv.exe
536	spoolsv.exe
536	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
3752	spoolsv.exe
3752	spoolsv.exe
2720	spoolsv.exe
2720	spoolsv.exe
2688	spoolsv.exe
2688	spoolsv.exe
3176	spoolsv.exe
3176	spoolsv.exe
4224	spoolsv.exe
4224	spoolsv.exe
1356	spoolsv.exe
1356	spoolsv.exe
3752	spoolsv.exe
3752	spoolsv.exe
3828	spoolsv.exe
3828	spoolsv.exe
5084	spoolsv.exe
5084	spoolsv.exe
2892	spoolsv.exe
2892	spoolsv.exe
4464	spoolsv.exe
4464	spoolsv.exe
1252	spoolsv.exe
1252	spoolsv.exe
1980	spoolsv.exe
1980	spoolsv.exe
312	spoolsv.exe
312	spoolsv.exe
4608	spoolsv.exe
4608	spoolsv.exe
4680	spoolsv.exe
4680	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
3192	spoolsv.exe
3192	spoolsv.exe
2936	spoolsv.exe
2936	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 4904 wrote to memory of 4088	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	splwow64.exe
PID 4904 wrote to memory of 4088	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	splwow64.exe
PID 4904 wrote to memory of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 4904 wrote to memory of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 4904 wrote to memory of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 4904 wrote to memory of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 4904 wrote to memory of 2068	4904	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
PID 2068 wrote to memory of 4752	2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	explorer.exe
PID 2068 wrote to memory of 4752	2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	explorer.exe
PID 2068 wrote to memory of 4752	2068	6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe	explorer.exe
PID 4752 wrote to memory of 60	4752	explorer.exe	explorer.exe
PID 4752 wrote to memory of 60	4752	explorer.exe	explorer.exe
PID 4752 wrote to memory of 60	4752	explorer.exe	explorer.exe
PID 4752 wrote to memory of 60	4752	explorer.exe	explorer.exe
PID 4752 wrote to memory of 60	4752	explorer.exe	explorer.exe
PID 60 wrote to memory of 4012	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4012	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4012	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3748	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3748	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3748	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4068	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4068	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4068	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2228	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2228	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2228	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2872	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2872	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2872	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3644	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3644	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3644	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4828	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4828	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4828	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1364	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1364	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1364	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4668	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4668	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 4668	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3576	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3576	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3576	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1756	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1756	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 1756	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2060	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2060	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2060	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 5028	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 5028	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 5028	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3220	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3220	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3220	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3380	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3380	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3380	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3512	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3512	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 3512	60	explorer.exe	spoolsv.exe
PID 60 wrote to memory of 2732	60	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:4088

C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f43490d501da4ae9e35a2e67ffe3049_JaffaCakes118.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4752

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4012

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:972

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4948

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3748

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4068

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2228

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2872

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1604

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3644

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4828

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3496

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4376

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:5260

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1364

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:536

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4668

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3180

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3576

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1756

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2720

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2060

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2688

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1100

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:5820

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5028

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3176

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3220

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4224

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2852

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:1400

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3380

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3512

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2732

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3828

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5072

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:1652

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4760

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4172

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3148

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4464

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1788

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1252

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4136

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2504

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:6100

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1988

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:312

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:716

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:4608

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2768

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:4680

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:1192

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:5452

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3484

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3628

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3020

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:2292

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3508

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3192

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:3724

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4228

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4752

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:2936

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:1496

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:5884

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3540

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4484

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:3676

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3140

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3524

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5656

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:5712

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5112

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5532

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:5644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6084

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:5540

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3196

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:5788

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:1544

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5332

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:5384

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4996

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:6096

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4964

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5176

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:1640

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5676

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3744

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5956

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3692

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5860

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4032

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5708

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3668

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:684

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:4116

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1036

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3472

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:2796

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4260

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:2316

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5952

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:3892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:5548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:5976

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:5392

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5932

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5300

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3452

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1500

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5340

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:6140

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5132

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5840

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\Parameters.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
2.2MB

MD5
b021a463a2fc753b60480804fa65a889

SHA1
c866c9788870a66ae90b9600dac13544ca0df609

SHA256
4b1e9f9aca4cfa004eab5f6bbd180497b79523a279c44f31eac440bacad0bbce

SHA512
e98c6900725d54ce9cd1d83ebeea543fe20b430467bdae477300679a5c055c85eb2c3bad158b7815a8e62f5c9f25e26d875e255e89840f1242ba7d1b4ca7ea29

Download Submit
\??\c:\windows\system\explorer.exe
Filesize
2.2MB

MD5
103616674cc2b3211462fd4547220f95

SHA1
48d7fb4a78c45e52a264cdbdf5fea078cc5de825

SHA256
ce1e205e6d3952802a1267b6003dec72b03af36570101fe365d9d7f4ccab0ace

SHA512
a28e0f61eb1121ad498ef98690a2f2ef2d95b6132e5a82f5f3a99e52af9cda12b848c3d3074b7ac217d11a7959e784d4607a9fd8858e1b9428b6f8d4ef175673

Download Submit
memory/60-94-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/60-899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/312-2793-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-2146-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/880-1962-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1252-2732-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1356-2495-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1364-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1400-4253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-2059-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-4608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1756-1532-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1788-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1836-2114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1980-2943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1980-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-1533-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2068-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2068-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-1053-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2228-2050-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2292-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-2468-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-2332-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-2261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2732-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2872-1154-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2892-2650-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2936-3407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2936-3501-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3140-5184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3148-1961-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3176-2341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3176-2345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-2233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3192-3141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3192-3245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3196-4792-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-1688-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3380-1689-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3496-2137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3512-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3576-1531-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3628-2974-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3628-2977-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-1155-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3748-1051-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3748-1963-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3752-2254-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-2506-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3828-2770-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3828-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-1952-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4012-900-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4068-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4068-1052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4136-2048-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4172-1949-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4224-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-2486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4228-4939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-5133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-2049-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4484-3832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4484-3960-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-1972-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4668-1348-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4680-2967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4680-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4752-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4760-1948-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4828-1156-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-0-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/4904-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-23-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/4948-3609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-1687-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5084-2643-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-5087-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5176-4949-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5260-3987-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5332-4905-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5452-4919-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5532-4244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5532-4366-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5656-4163-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5708-5059-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5708-5056-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5820-4101-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5860-4982-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5860-4987-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5884-4977-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5952-5321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5956-4965-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5956-4968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6084-4596-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6100-4828-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download