pony | 6ee18679a30920f4f59eb4f9c104efcd5e200e40578da7079635efb915a323a7

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
Size 2.2MB
Sample240528-gd67ragc51
SHA256 6ee18679a30920f4f59eb4f9c104efcd5e200e40578da7079635efb915a323a7
MD5 7be553acdcc7a17b9da3ea1ec44c0668
SHA1 70590f7f573723f673d86e90f2196fc46bca83a1
SHA512 971d10a7ff05a03a63297e3e9d13d49579b72b5caaef23803cce1c6dcd92eaefe647cd3dc5fc0c8c0a50f8cdfb0d146ab9b5a3f6fa406b4cfc32d3f8e845e0a9
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
388	explorer.exe
3752	explorer.exe
4744	spoolsv.exe
448	spoolsv.exe
2540	spoolsv.exe
2412	spoolsv.exe
1240	spoolsv.exe
3932	spoolsv.exe
2768	spoolsv.exe
4684	spoolsv.exe
4628	spoolsv.exe
820	spoolsv.exe
3800	spoolsv.exe
5080	spoolsv.exe
4396	spoolsv.exe
4880	spoolsv.exe
1056	spoolsv.exe
688	spoolsv.exe
4440	spoolsv.exe
4172	spoolsv.exe
4248	spoolsv.exe
4160	spoolsv.exe
376	spoolsv.exe
4012	spoolsv.exe
4636	spoolsv.exe
876	spoolsv.exe
4452	spoolsv.exe
2476	spoolsv.exe
5040	spoolsv.exe
5076	spoolsv.exe
4600	spoolsv.exe
992	spoolsv.exe
4556	spoolsv.exe
3052	spoolsv.exe
1512	spoolsv.exe
3808	spoolsv.exe
1084	explorer.exe
4976	spoolsv.exe
4508	spoolsv.exe
4044	spoolsv.exe
1232	spoolsv.exe
4468	spoolsv.exe
3232	spoolsv.exe
5100	explorer.exe
2976	spoolsv.exe
3280	spoolsv.exe
3660	spoolsv.exe
4564	spoolsv.exe
4716	spoolsv.exe
4320	spoolsv.exe
4792	explorer.exe
1680	spoolsv.exe
388	spoolsv.exe
212	spoolsv.exe
3256	spoolsv.exe
612	spoolsv.exe
1248	spoolsv.exe
4928	spoolsv.exe
2848	spoolsv.exe
2584	spoolsv.exe
4940	explorer.exe
1152	spoolsv.exe
1384	spoolsv.exe
660	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 46 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 388 set thread context of 3752	388	explorer.exe	99
PID 4744 set thread context of 3808	4744	spoolsv.exe	133
PID 448 set thread context of 4976	448	spoolsv.exe	135
PID 2540 set thread context of 4508	2540	spoolsv.exe	136
PID 2412 set thread context of 4044	2412	spoolsv.exe	137
PID 1240 set thread context of 4468	1240	spoolsv.exe	139
PID 3932 set thread context of 3232	3932	spoolsv.exe	140
PID 2768 set thread context of 2976	2768	spoolsv.exe	142
PID 4684 set thread context of 3660	4684	spoolsv.exe	144
PID 4628 set thread context of 4564	4628	spoolsv.exe	145
PID 820 set thread context of 4716	820	spoolsv.exe	146
PID 3800 set thread context of 4320	3800	spoolsv.exe	147
PID 5080 set thread context of 1680	5080	spoolsv.exe	149
PID 4396 set thread context of 388	4396	spoolsv.exe	150
PID 4880 set thread context of 212	4880	spoolsv.exe	151
PID 1056 set thread context of 612	1056	spoolsv.exe	153
PID 688 set thread context of 1248	688	spoolsv.exe	154
PID 4440 set thread context of 4928	4440	spoolsv.exe	155
PID 4172 set thread context of 2848	4172	spoolsv.exe	156
PID 4248 set thread context of 2584	4248	spoolsv.exe	157
PID 4160 set thread context of 1384	4160	spoolsv.exe	160
PID 376 set thread context of 660	376	spoolsv.exe	161
PID 4012 set thread context of 1912	4012	spoolsv.exe	162
PID 4636 set thread context of 4904	4636	spoolsv.exe	163
PID 876 set thread context of 220	876	spoolsv.exe	164
PID 4452 set thread context of 1572	4452	spoolsv.exe	166
PID 2476 set thread context of 3672	2476	spoolsv.exe	168
PID 5040 set thread context of 3640	5040	spoolsv.exe	169
PID 5076 set thread context of 1288	5076	spoolsv.exe	171
PID 4600 set thread context of 3484	4600	spoolsv.exe	173
PID 992 set thread context of 2792	992	spoolsv.exe	174
PID 4556 set thread context of 3152	4556	spoolsv.exe	176
PID 3052 set thread context of 3436	3052	spoolsv.exe	177
PID 1512 set thread context of 4540	1512	spoolsv.exe	181
PID 1084 set thread context of 824	1084	explorer.exe	184
PID 1232 set thread context of 4844	1232	spoolsv.exe	187
PID 5100 set thread context of 1720	5100	explorer.exe	192
PID 3280 set thread context of 456	3280	spoolsv.exe	195
PID 4792 set thread context of 1468	4792	explorer.exe	200
PID 3256 set thread context of 2832	3256	spoolsv.exe	202
PID 1152 set thread context of 3544	1152	spoolsv.exe	207
PID 4940 set thread context of 2764	4940	explorer.exe	209
PID 1656 set thread context of 1664	1656	explorer.exe	212
PID 1676 set thread context of 3120	1676	spoolsv.exe	213
PID 4224 set thread context of 4820	4224	spoolsv.exe	217

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3752	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3752	explorer.exe
3808	spoolsv.exe
3808	spoolsv.exe
4976	spoolsv.exe
4976	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
4044	spoolsv.exe
4044	spoolsv.exe
4468	spoolsv.exe
4468	spoolsv.exe
3232	spoolsv.exe
3232	spoolsv.exe
2976	spoolsv.exe
2976	spoolsv.exe
3660	spoolsv.exe
3660	spoolsv.exe
4564	spoolsv.exe
4564	spoolsv.exe
4716	spoolsv.exe
4716	spoolsv.exe
4320	spoolsv.exe
4320	spoolsv.exe
1680	spoolsv.exe
1680	spoolsv.exe
388	spoolsv.exe
388	spoolsv.exe
212	spoolsv.exe
212	spoolsv.exe
612	spoolsv.exe
612	spoolsv.exe
1248	spoolsv.exe
1248	spoolsv.exe
4928	spoolsv.exe
4928	spoolsv.exe
2848	spoolsv.exe
2848	spoolsv.exe
2584	spoolsv.exe
2584	spoolsv.exe
1384	spoolsv.exe
1384	spoolsv.exe
660	spoolsv.exe
660	spoolsv.exe
1912	spoolsv.exe
1912	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
220	spoolsv.exe
220	spoolsv.exe
1572	spoolsv.exe
1572	spoolsv.exe
3672	spoolsv.exe
3672	spoolsv.exe
3640	spoolsv.exe
3640	spoolsv.exe
1288	spoolsv.exe
1288	spoolsv.exe
3484	spoolsv.exe
3484	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1012	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	84
PID 2068 wrote to memory of 1012	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	84
PID 2068 wrote to memory of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 2068 wrote to memory of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 2068 wrote to memory of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 2068 wrote to memory of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 2068 wrote to memory of 3784	2068	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	96
PID 3784 wrote to memory of 388	3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	97
PID 3784 wrote to memory of 388	3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	97
PID 3784 wrote to memory of 388	3784	7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe	97
PID 388 wrote to memory of 3752	388	explorer.exe	99
PID 388 wrote to memory of 3752	388	explorer.exe	99
PID 388 wrote to memory of 3752	388	explorer.exe	99
PID 388 wrote to memory of 3752	388	explorer.exe	99
PID 388 wrote to memory of 3752	388	explorer.exe	99
PID 3752 wrote to memory of 4744	3752	explorer.exe	100
PID 3752 wrote to memory of 4744	3752	explorer.exe	100
PID 3752 wrote to memory of 4744	3752	explorer.exe	100
PID 3752 wrote to memory of 448	3752	explorer.exe	101
PID 3752 wrote to memory of 448	3752	explorer.exe	101
PID 3752 wrote to memory of 448	3752	explorer.exe	101
PID 3752 wrote to memory of 2540	3752	explorer.exe	102
PID 3752 wrote to memory of 2540	3752	explorer.exe	102
PID 3752 wrote to memory of 2540	3752	explorer.exe	102
PID 3752 wrote to memory of 2412	3752	explorer.exe	103
PID 3752 wrote to memory of 2412	3752	explorer.exe	103
PID 3752 wrote to memory of 2412	3752	explorer.exe	103
PID 3752 wrote to memory of 1240	3752	explorer.exe	104
PID 3752 wrote to memory of 1240	3752	explorer.exe	104
PID 3752 wrote to memory of 1240	3752	explorer.exe	104
PID 3752 wrote to memory of 3932	3752	explorer.exe	105
PID 3752 wrote to memory of 3932	3752	explorer.exe	105
PID 3752 wrote to memory of 3932	3752	explorer.exe	105
PID 3752 wrote to memory of 2768	3752	explorer.exe	106
PID 3752 wrote to memory of 2768	3752	explorer.exe	106
PID 3752 wrote to memory of 2768	3752	explorer.exe	106
PID 3752 wrote to memory of 4684	3752	explorer.exe	107
PID 3752 wrote to memory of 4684	3752	explorer.exe	107
PID 3752 wrote to memory of 4684	3752	explorer.exe	107
PID 3752 wrote to memory of 4628	3752	explorer.exe	108
PID 3752 wrote to memory of 4628	3752	explorer.exe	108
PID 3752 wrote to memory of 4628	3752	explorer.exe	108
PID 3752 wrote to memory of 820	3752	explorer.exe	109
PID 3752 wrote to memory of 820	3752	explorer.exe	109
PID 3752 wrote to memory of 820	3752	explorer.exe	109
PID 3752 wrote to memory of 3800	3752	explorer.exe	110
PID 3752 wrote to memory of 3800	3752	explorer.exe	110
PID 3752 wrote to memory of 3800	3752	explorer.exe	110
PID 3752 wrote to memory of 5080	3752	explorer.exe	111
PID 3752 wrote to memory of 5080	3752	explorer.exe	111
PID 3752 wrote to memory of 5080	3752	explorer.exe	111
PID 3752 wrote to memory of 4396	3752	explorer.exe	112
PID 3752 wrote to memory of 4396	3752	explorer.exe	112
PID 3752 wrote to memory of 4396	3752	explorer.exe	112
PID 3752 wrote to memory of 4880	3752	explorer.exe	113
PID 3752 wrote to memory of 4880	3752	explorer.exe	113
PID 3752 wrote to memory of 4880	3752	explorer.exe	113
PID 3752 wrote to memory of 1056	3752	explorer.exe	114
PID 3752 wrote to memory of 1056	3752	explorer.exe	114
PID 3752 wrote to memory of 1056	3752	explorer.exe	114
PID 3752 wrote to memory of 688	3752	explorer.exe	115
PID 3752 wrote to memory of 688	3752	explorer.exe	115
PID 3752 wrote to memory of 688	3752	explorer.exe	115
PID 3752 wrote to memory of 4440	3752	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1012
- C:\Users\Admin\AppData\Local\Temp\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7be553acdcc7a17b9da3ea1ec44c0668_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3784
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:388
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3808
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5100
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4940
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1656
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3620
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2840
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2276
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2832
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:884
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 3bb7688f8fcdace5cad184ad94324bb0a9c160c44fb9f1faa1320e7463c6c7ce
MD5 c50647ca64cc990ab76104cb9ea6ccc6
SHA1 3ff8e05184b2f7c417d18fbc88cf08d72a003153
SHA512 eec740d102ca7941c97897000b56a345e4a18bb7465e0565815b515d5b43aab5d764513a6280f916994e4abb2ceab80654c2d9e7e537a4b0edc07f2d32fb3661
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 2.2MB
SHA256 89396febf1821ff091fb726a46b1e85294602113d2001cd2312bee1814077091
MD5 93340b8f5640ef297d74039ed48760fb
SHA1 862d9b5464c58b17fc760432b3cb694fc2830983
SHA512 dd1b0d518a833b81154565256c34e8b0709fc17c3bcc90db3aafa250ee73012d461f2f3d48c096d4d55a98321e5d0b89c3c8b8fcda5dabab3254f7d286afbd09
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-2663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-3004-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/376-2236-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/388-2651-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/388-2654-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/388-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/388-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/448-952-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/448-2248-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/456-4490-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/456-4417-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/612-2752-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/688-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/820-1555-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/824-3794-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-2261-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/884-5985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-5890-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1056-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1060-5415-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1240-1145-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1248-2772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-3313-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-3470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-2948-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-2952-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1468-4564-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1664-5171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1680-2640-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1720-4200-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1720-4197-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1912-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2068-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2068-43-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2068-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2068-0-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2396-5788-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2412-1144-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2540-1143-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2540-2259-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2584-3104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2584-2871-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-5507-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-5645-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-4955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-4959-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2792-3341-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2792-3337-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2832-4635-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2832-4779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2848-2795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2916-5425-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2976-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-5177-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-5285-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-3431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3232-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3232-2418-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3328-5759-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3436-3625-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-3332-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-3328-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3544-5072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3544-4946-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3640-3174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3660-2507-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3752-950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3752-91-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-48-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3800-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3804-5919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-2383-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3932-1346-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3940-5666-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4012-2237-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4044-2268-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4160-2162-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4172-2160-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4248-2161-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4320-2853-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4320-2631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-1755-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4440-1967-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-5779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-2354-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-2257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-2255-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4520-5836-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-5636-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-3703-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-2525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-2530-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4576-5655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-1554-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4636-2249-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4684-1553-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4716-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-5403-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4744-951-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4744-2239-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4820-5482-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-5391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-4038-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-3919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-1964-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4904-2982-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-2782-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-2246-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4984-5772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-1754-0x0000000000400000-0x00000000005D3000-memory.dmp

Download