pony | 52066c9aee6d12c924a0ce0e83d51175e9a32f09bb44483ccd527b51a3b9c6c7

Analysis

max time kernel
146s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
Size

2.2MB
MD5

7a8f31b29b3ec7a1b564d1d369f8b4b4
SHA1

be7d7448ff6f93448240f2e47a2056026f333335
SHA256

52066c9aee6d12c924a0ce0e83d51175e9a32f09bb44483ccd527b51a3b9c6c7
SHA512

348bce68439f6aa573784c468efdcd10c44b201121c1227be31475da82f65430d099aca6adfcbb23f59bc8a32ba3ade63a0fdd2f8d8d3616954c7d4ebdc9c03f
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwA

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exe

pid	process
2864	explorer.exe
2256	explorer.exe
3648	spoolsv.exe
4612	spoolsv.exe
1860	spoolsv.exe
5112	spoolsv.exe
4736	spoolsv.exe
4812	spoolsv.exe
3364	spoolsv.exe
4564	spoolsv.exe
3656	spoolsv.exe
1892	spoolsv.exe
4152	spoolsv.exe
3676	spoolsv.exe
2336	spoolsv.exe
3404	spoolsv.exe
4340	spoolsv.exe
2712	spoolsv.exe
3160	spoolsv.exe
4076	spoolsv.exe
3736	spoolsv.exe
3640	spoolsv.exe
4532	spoolsv.exe
1688	spoolsv.exe
5080	spoolsv.exe
1016	spoolsv.exe
1380	spoolsv.exe
2884	spoolsv.exe
2012	spoolsv.exe
2544	spoolsv.exe
4964	spoolsv.exe
4884	spoolsv.exe
2472	spoolsv.exe
2860	spoolsv.exe
452	spoolsv.exe
2212	explorer.exe
3600	spoolsv.exe
3612	spoolsv.exe
4748	spoolsv.exe
372	spoolsv.exe
4084	spoolsv.exe
4992	spoolsv.exe
3684	spoolsv.exe
3084	spoolsv.exe
3864	spoolsv.exe
4368	explorer.exe
3508	spoolsv.exe
1348	spoolsv.exe
4968	spoolsv.exe
4804	spoolsv.exe
1312	spoolsv.exe
3136	spoolsv.exe
4692	spoolsv.exe
4780	spoolsv.exe
460	spoolsv.exe
244	explorer.exe
3904	spoolsv.exe
3624	spoolsv.exe
3924	spoolsv.exe
1944	spoolsv.exe
3644	spoolsv.exe
1224	explorer.exe
2172	spoolsv.exe
4944	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

Processes:

7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 1188 set thread context of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 2864 set thread context of 2256	2864	explorer.exe	explorer.exe
PID 3648 set thread context of 452	3648	spoolsv.exe	spoolsv.exe
PID 4612 set thread context of 3600	4612	spoolsv.exe	spoolsv.exe
PID 1860 set thread context of 4748	1860	spoolsv.exe	spoolsv.exe
PID 5112 set thread context of 372	5112	spoolsv.exe	spoolsv.exe
PID 4736 set thread context of 4084	4736	spoolsv.exe	spoolsv.exe
PID 4812 set thread context of 4992	4812	spoolsv.exe	spoolsv.exe
PID 3364 set thread context of 3684	3364	spoolsv.exe	spoolsv.exe
PID 4564 set thread context of 3864	4564	spoolsv.exe	spoolsv.exe
PID 3656 set thread context of 3508	3656	spoolsv.exe	spoolsv.exe
PID 1892 set thread context of 1348	1892	spoolsv.exe	spoolsv.exe
PID 3676 set thread context of 4804	3676	spoolsv.exe	spoolsv.exe
PID 2336 set thread context of 1312	2336	spoolsv.exe	spoolsv.exe
PID 3404 set thread context of 3136	3404	spoolsv.exe	spoolsv.exe
PID 4340 set thread context of 4692	4340	spoolsv.exe	spoolsv.exe
PID 2712 set thread context of 460	2712	spoolsv.exe	spoolsv.exe
PID 3160 set thread context of 3624	3160	spoolsv.exe	spoolsv.exe
PID 4076 set thread context of 3924	4076	spoolsv.exe	spoolsv.exe
PID 3736 set thread context of 1944	3736	spoolsv.exe	spoolsv.exe
PID 3640 set thread context of 3644	3640	spoolsv.exe	spoolsv.exe
PID 4532 set thread context of 4944	4532	spoolsv.exe	spoolsv.exe
PID 1688 set thread context of 4708	1688	spoolsv.exe	spoolsv.exe
PID 5080 set thread context of 3368	5080	spoolsv.exe	spoolsv.exe
PID 1016 set thread context of 1652	1016	spoolsv.exe	spoolsv.exe
PID 1380 set thread context of 3956	1380	spoolsv.exe	spoolsv.exe
PID 2884 set thread context of 2004	2884	spoolsv.exe	spoolsv.exe
PID 2012 set thread context of 1928	2012	spoolsv.exe	spoolsv.exe
PID 2544 set thread context of 4536	2544	spoolsv.exe	spoolsv.exe
PID 4964 set thread context of 4476	4964	spoolsv.exe	spoolsv.exe
PID 4884 set thread context of 4696	4884	spoolsv.exe	spoolsv.exe
PID 2472 set thread context of 5044	2472	spoolsv.exe	spoolsv.exe
PID 2860 set thread context of 3036	2860	spoolsv.exe	spoolsv.exe
PID 2212 set thread context of 1048	2212	explorer.exe	explorer.exe
PID 3612 set thread context of 2880	3612	spoolsv.exe	spoolsv.exe
PID 3084 set thread context of 5032	3084	spoolsv.exe	spoolsv.exe
PID 4368 set thread context of 1852	4368	explorer.exe	explorer.exe
PID 4780 set thread context of 2296	4780	spoolsv.exe	spoolsv.exe
PID 244 set thread context of 1512	244	explorer.exe	explorer.exe
PID 3904 set thread context of 4380	3904	spoolsv.exe	spoolsv.exe
PID 1224 set thread context of 2100	1224	explorer.exe	explorer.exe
PID 2172 set thread context of 2672	2172	spoolsv.exe	spoolsv.exe
PID 2144 set thread context of 3092	2144	explorer.exe	explorer.exe
PID 4432 set thread context of 1284	4432	spoolsv.exe	spoolsv.exe
PID 3168 set thread context of 4740	3168	spoolsv.exe	spoolsv.exe
PID 1996 set thread context of 4048	1996	explorer.exe	explorer.exe
PID 4600 set thread context of 1816	4600	spoolsv.exe	spoolsv.exe
PID 3372 set thread context of 1808	3372	spoolsv.exe	spoolsv.exe
PID 4344 set thread context of 1496	4344	explorer.exe	explorer.exe
PID 4724 set thread context of 2540	4724	spoolsv.exe	spoolsv.exe
PID 5012 set thread context of 924	5012	spoolsv.exe	spoolsv.exe
PID 4580 set thread context of 2668	4580	spoolsv.exe	spoolsv.exe
PID 3000 set thread context of 428	3000	explorer.exe	explorer.exe
PID 4680 set thread context of 2852	4680	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exe7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exe7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exeexplorer.exe

pid	process
4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2256 explorer.exe

pid	process
2256	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

pid	process
4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
2256	explorer.exe
452	spoolsv.exe
452	spoolsv.exe
3600	spoolsv.exe
3600	spoolsv.exe
4748	spoolsv.exe
4748	spoolsv.exe
372	spoolsv.exe
372	spoolsv.exe
4084	spoolsv.exe
4084	spoolsv.exe
4992	spoolsv.exe
4992	spoolsv.exe
3684	spoolsv.exe
3684	spoolsv.exe
3864	spoolsv.exe
3864	spoolsv.exe
3508	spoolsv.exe
3508	spoolsv.exe
1348	spoolsv.exe
1348	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
4804	spoolsv.exe
4804	spoolsv.exe
1312	spoolsv.exe
1312	spoolsv.exe
3136	spoolsv.exe
3136	spoolsv.exe
4692	spoolsv.exe
4692	spoolsv.exe
460	spoolsv.exe
460	spoolsv.exe
3624	spoolsv.exe
3624	spoolsv.exe
3924	spoolsv.exe
3924	spoolsv.exe
1944	spoolsv.exe
1944	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe
4708	spoolsv.exe
4708	spoolsv.exe
3368	spoolsv.exe
3368	spoolsv.exe
1652	spoolsv.exe
1652	spoolsv.exe
3956	spoolsv.exe
3956	spoolsv.exe
2004	spoolsv.exe
2004	spoolsv.exe
1928	spoolsv.exe
1928	spoolsv.exe
4536	spoolsv.exe
4536	spoolsv.exe
4476	spoolsv.exe
4476	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 1188 wrote to memory of 2200	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	splwow64.exe
PID 1188 wrote to memory of 2200	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	splwow64.exe
PID 1188 wrote to memory of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 1188 wrote to memory of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 1188 wrote to memory of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 1188 wrote to memory of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 1188 wrote to memory of 4572	1188	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
PID 4572 wrote to memory of 2864	4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	explorer.exe
PID 4572 wrote to memory of 2864	4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	explorer.exe
PID 4572 wrote to memory of 2864	4572	7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe	explorer.exe
PID 2864 wrote to memory of 2256	2864	explorer.exe	explorer.exe
PID 2864 wrote to memory of 2256	2864	explorer.exe	explorer.exe
PID 2864 wrote to memory of 2256	2864	explorer.exe	explorer.exe
PID 2864 wrote to memory of 2256	2864	explorer.exe	explorer.exe
PID 2864 wrote to memory of 2256	2864	explorer.exe	explorer.exe
PID 2256 wrote to memory of 3648	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3648	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3648	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4612	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4612	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4612	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1860	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1860	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1860	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 5112	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 5112	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 5112	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4736	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4736	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4736	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4812	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4812	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4812	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3364	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3364	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3364	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4564	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4564	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4564	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3656	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3656	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3656	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1892	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1892	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 1892	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4152	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4152	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4152	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3676	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3676	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3676	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2336	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2336	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2336	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3404	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3404	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3404	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4340	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4340	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 4340	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2712	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2712	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 2712	2256	explorer.exe	spoolsv.exe
PID 2256 wrote to memory of 3160	2256	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8f31b29b3ec7a1b564d1d369f8b4b4_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4572
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4368
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:460
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:244
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2144
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4696
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1996
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4344
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3000
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5032
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2296
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\Parameters.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
a33aaf1c8784d2db959e21d81623fcbd

SHA1
c336de6e45e41d846cc9ca44680bb4a4225076e4

SHA256
23345718e596b3badfe1a07b4e6ed70a1d8e156bb2603cba615e7e5bfd6c5558

SHA512
b378eebfe8de0e51a13dd4c4be7b7376f94b09742a5631e8c5066feecfdc3d30fe7327305df3f4c300cdc27e5e7b1295d6a5716799026b574a35071025dbdf53

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
a082f70df8c86f831792cf1ba61001ce

SHA1
e1224b1c9cf2c6b193ecbb767895c2c8bd110a0f

SHA256
853f3dbabb36e79f384c880951cdc03faba1a78136bddf5a0f7d533bb0c2174a

SHA512
fc861b8dc22e6c1aaf5380212c831480cea04ac7f8d9e2b368a6e15623c5a7b6448f7e3c667f10901c111568646fbe9f06f44371d8de13a1516c50c05b29266c

Download Submit
memory/372-2226-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/428-5262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-2136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-2301-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/460-2581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/460-2763-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/924-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1048-3629-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1188-52-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1188-0-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1188-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1188-48-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1284-4965-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1312-2443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1348-2411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1512-4312-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-2882-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1688-2146-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1816-4991-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1852-3995-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-1026-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1860-2213-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1892-1438-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1944-2688-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2004-2949-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2100-4580-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2296-4248-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-1659-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2540-5016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-5222-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-4588-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-4710-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-1860-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2852-5338-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-5462-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2864-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2880-3636-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2880-3759-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-3403-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-3497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3092-4814-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-2453-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3160-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3364-1225-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3368-2874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-1660-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3508-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3600-2151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3600-2147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-2668-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3640-2134-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3644-2781-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-2942-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3648-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3648-969-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3656-1437-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3676-1658-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3736-2036-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3864-2540-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3864-2389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3924-2679-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-2893-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-4917-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-2035-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4084-2236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4152-1656-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4340-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4380-4333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-4447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4464-5566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4464-5674-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4532-2135-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4536-3032-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4564-1226-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4572-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4572-51-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-78-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-1025-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4612-2149-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4692-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-2490-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4696-3284-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4696-3201-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4708-2864-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4736-1223-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4740-4904-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-2211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4756-5414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4804-2430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-1224-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4968-2417-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-3985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5044-3210-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-2210-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5112-1027-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download