pony | 90644041e0683f6ff3f60f7004531bd6e2eac33e5e9bc7fe53630d76dfe3cc58

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
Size 2.2MB
Sample240530-eq4ahsfa26
SHA256 90644041e0683f6ff3f60f7004531bd6e2eac33e5e9bc7fe53630d76dfe3cc58
MD5 63cff513d52c8bd5e9f413e8524abb61
SHA1 89c2c9093df991951df3b584e1e54de54570f3fe
SHA512 4025bf808d7ce2d324c2128792da855b0b68a9a064f79c075e404daf793736da89c6704faa23469122cc2c1b387c8f890db2f90a7c436b35560ea0447a33def7
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1156	explorer.exe
3300	explorer.exe
1360	spoolsv.exe
4268	spoolsv.exe
3312	spoolsv.exe
452	spoolsv.exe
5024	spoolsv.exe
804	spoolsv.exe
3160	spoolsv.exe
1644	spoolsv.exe
2464	spoolsv.exe
1596	spoolsv.exe
2744	spoolsv.exe
2104	spoolsv.exe
4760	spoolsv.exe
3668	spoolsv.exe
4052	spoolsv.exe
1488	spoolsv.exe
1392	spoolsv.exe
3792	spoolsv.exe
1268	spoolsv.exe
2952	spoolsv.exe
3452	spoolsv.exe
1432	spoolsv.exe
1324	spoolsv.exe
4020	spoolsv.exe
4772	spoolsv.exe
2296	spoolsv.exe
872	spoolsv.exe
3992	spoolsv.exe
3544	spoolsv.exe
3244	spoolsv.exe
688	spoolsv.exe
3976	spoolsv.exe
2216	spoolsv.exe
4464	spoolsv.exe
3780	spoolsv.exe
4216	spoolsv.exe
2956	explorer.exe
960	spoolsv.exe
2776	spoolsv.exe
2680	spoolsv.exe
1676	spoolsv.exe
2124	spoolsv.exe
4148	spoolsv.exe
5064	spoolsv.exe
4400	spoolsv.exe
60	spoolsv.exe
1132	spoolsv.exe
2396	spoolsv.exe
2320	explorer.exe
2708	spoolsv.exe
4024	spoolsv.exe
3488	spoolsv.exe
3860	spoolsv.exe
1680	spoolsv.exe
3952	spoolsv.exe
2176	spoolsv.exe
4220	spoolsv.exe
5048	spoolsv.exe
2924	explorer.exe
3512	spoolsv.exe
2324	spoolsv.exe
4344	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 59 IoCs

description	pid	Process	procid_target
PID 4932 set thread context of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 1156 set thread context of 3300	1156	explorer.exe	97
PID 1360 set thread context of 4216	1360	spoolsv.exe	133
PID 4268 set thread context of 960	4268	spoolsv.exe	135
PID 3312 set thread context of 2680	3312	spoolsv.exe	137
PID 452 set thread context of 1676	452	spoolsv.exe	138
PID 5024 set thread context of 2124	5024	spoolsv.exe	139
PID 804 set thread context of 4148	804	spoolsv.exe	140
PID 3160 set thread context of 5064	3160	spoolsv.exe	141
PID 1644 set thread context of 4400	1644	spoolsv.exe	142
PID 2464 set thread context of 60	2464	spoolsv.exe	143
PID 1596 set thread context of 2396	1596	spoolsv.exe	145
PID 2744 set thread context of 2708	2744	spoolsv.exe	147
PID 2104 set thread context of 4024	2104	spoolsv.exe	148
PID 4760 set thread context of 3488	4760	spoolsv.exe	149
PID 3668 set thread context of 3860	3668	spoolsv.exe	150
PID 4052 set thread context of 1680	4052	spoolsv.exe	151
PID 1488 set thread context of 3952	1488	spoolsv.exe	152
PID 1392 set thread context of 2176	1392	spoolsv.exe	153
PID 3792 set thread context of 5048	3792	spoolsv.exe	155
PID 1268 set thread context of 3512	1268	spoolsv.exe	157
PID 2952 set thread context of 2324	2952	spoolsv.exe	158
PID 3452 set thread context of 4344	3452	spoolsv.exe	159
PID 1432 set thread context of 868	1432	spoolsv.exe	160
PID 1324 set thread context of 2672	1324	spoolsv.exe	162
PID 4020 set thread context of 2292	4020	spoolsv.exe	164
PID 4772 set thread context of 3868	4772	spoolsv.exe	165
PID 2296 set thread context of 2908	2296	spoolsv.exe	166
PID 872 set thread context of 1288	872	spoolsv.exe	167
PID 3992 set thread context of 2184	3992	spoolsv.exe	168
PID 3544 set thread context of 3932	3544	spoolsv.exe	170
PID 3244 set thread context of 2692	3244	spoolsv.exe	171
PID 688 set thread context of 1284	688	spoolsv.exe	173
PID 3976 set thread context of 4796	3976	spoolsv.exe	174
PID 2216 set thread context of 3472	2216	spoolsv.exe	175
PID 4464 set thread context of 1152	4464	spoolsv.exe	177
PID 3780 set thread context of 884	3780	spoolsv.exe	181
PID 2776 set thread context of 3620	2776	spoolsv.exe	187
PID 2956 set thread context of 228	2956	explorer.exe	189
PID 2320 set thread context of 4560	2320	explorer.exe	194
PID 1132 set thread context of 5116	1132	spoolsv.exe	195
PID 4220 set thread context of 1740	4220	spoolsv.exe	200
PID 2924 set thread context of 856	2924	explorer.exe	202
PID 2388 set thread context of 448	2388	spoolsv.exe	208
PID 4620 set thread context of 3104	4620	explorer.exe	210
PID 536 set thread context of 2160	536	spoolsv.exe	213
PID 2972 set thread context of 4584	2972	explorer.exe	215
PID 4904 set thread context of 3504	4904	spoolsv.exe	216
PID 3324 set thread context of 1276	3324	explorer.exe	217
PID 2768 set thread context of 1308	2768	spoolsv.exe	218
PID 4436 set thread context of 3128	4436	spoolsv.exe	220
PID 396 set thread context of 4468	396	explorer.exe	221
PID 5020 set thread context of 4968	5020	spoolsv.exe	222
PID 864 set thread context of 2452	864	spoolsv.exe	225
PID 208 set thread context of 2180	208	spoolsv.exe	227
PID 3636 set thread context of 3684	3636	spoolsv.exe	230
PID 1004 set thread context of 4060	1004	explorer.exe	232
PID 3376 set thread context of 1628	3376	spoolsv.exe	233
PID 116 set thread context of 932	116	spoolsv.exe	235

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
3300	explorer.exe
4216	spoolsv.exe
4216	spoolsv.exe
960	spoolsv.exe
960	spoolsv.exe
2680	spoolsv.exe
2680	spoolsv.exe
1676	spoolsv.exe
1676	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
4148	spoolsv.exe
4148	spoolsv.exe
5064	spoolsv.exe
5064	spoolsv.exe
4400	spoolsv.exe
4400	spoolsv.exe
60	spoolsv.exe
60	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
2708	spoolsv.exe
2708	spoolsv.exe
4024	spoolsv.exe
4024	spoolsv.exe
3488	spoolsv.exe
3488	spoolsv.exe
3860	spoolsv.exe
3860	spoolsv.exe
1680	spoolsv.exe
1680	spoolsv.exe
3952	spoolsv.exe
3952	spoolsv.exe
2176	spoolsv.exe
2176	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe
3512	spoolsv.exe
3512	spoolsv.exe
2324	spoolsv.exe
2324	spoolsv.exe
4344	spoolsv.exe
4344	spoolsv.exe
868	spoolsv.exe
868	spoolsv.exe
2672	spoolsv.exe
2672	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
3868	spoolsv.exe
3868	spoolsv.exe
2908	spoolsv.exe
2908	spoolsv.exe
1288	spoolsv.exe
1288	spoolsv.exe
2184	spoolsv.exe
2184	spoolsv.exe
3932	spoolsv.exe
3932	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4532	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	82
PID 4932 wrote to memory of 4532	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	82
PID 4932 wrote to memory of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 4932 wrote to memory of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 4932 wrote to memory of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 4932 wrote to memory of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 4932 wrote to memory of 4676	4932	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	94
PID 4676 wrote to memory of 1156	4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	95
PID 4676 wrote to memory of 1156	4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	95
PID 4676 wrote to memory of 1156	4676	63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe	95
PID 1156 wrote to memory of 3300	1156	explorer.exe	97
PID 1156 wrote to memory of 3300	1156	explorer.exe	97
PID 1156 wrote to memory of 3300	1156	explorer.exe	97
PID 1156 wrote to memory of 3300	1156	explorer.exe	97
PID 1156 wrote to memory of 3300	1156	explorer.exe	97
PID 3300 wrote to memory of 1360	3300	explorer.exe	98
PID 3300 wrote to memory of 1360	3300	explorer.exe	98
PID 3300 wrote to memory of 1360	3300	explorer.exe	98
PID 3300 wrote to memory of 4268	3300	explorer.exe	99
PID 3300 wrote to memory of 4268	3300	explorer.exe	99
PID 3300 wrote to memory of 4268	3300	explorer.exe	99
PID 3300 wrote to memory of 3312	3300	explorer.exe	100
PID 3300 wrote to memory of 3312	3300	explorer.exe	100
PID 3300 wrote to memory of 3312	3300	explorer.exe	100
PID 3300 wrote to memory of 452	3300	explorer.exe	101
PID 3300 wrote to memory of 452	3300	explorer.exe	101
PID 3300 wrote to memory of 452	3300	explorer.exe	101
PID 3300 wrote to memory of 5024	3300	explorer.exe	102
PID 3300 wrote to memory of 5024	3300	explorer.exe	102
PID 3300 wrote to memory of 5024	3300	explorer.exe	102
PID 3300 wrote to memory of 804	3300	explorer.exe	103
PID 3300 wrote to memory of 804	3300	explorer.exe	103
PID 3300 wrote to memory of 804	3300	explorer.exe	103
PID 3300 wrote to memory of 3160	3300	explorer.exe	104
PID 3300 wrote to memory of 3160	3300	explorer.exe	104
PID 3300 wrote to memory of 3160	3300	explorer.exe	104
PID 3300 wrote to memory of 1644	3300	explorer.exe	105
PID 3300 wrote to memory of 1644	3300	explorer.exe	105
PID 3300 wrote to memory of 1644	3300	explorer.exe	105
PID 3300 wrote to memory of 2464	3300	explorer.exe	106
PID 3300 wrote to memory of 2464	3300	explorer.exe	106
PID 3300 wrote to memory of 2464	3300	explorer.exe	106
PID 3300 wrote to memory of 1596	3300	explorer.exe	107
PID 3300 wrote to memory of 1596	3300	explorer.exe	107
PID 3300 wrote to memory of 1596	3300	explorer.exe	107
PID 3300 wrote to memory of 2744	3300	explorer.exe	108
PID 3300 wrote to memory of 2744	3300	explorer.exe	108
PID 3300 wrote to memory of 2744	3300	explorer.exe	108
PID 3300 wrote to memory of 2104	3300	explorer.exe	109
PID 3300 wrote to memory of 2104	3300	explorer.exe	109
PID 3300 wrote to memory of 2104	3300	explorer.exe	109
PID 3300 wrote to memory of 4760	3300	explorer.exe	110
PID 3300 wrote to memory of 4760	3300	explorer.exe	110
PID 3300 wrote to memory of 4760	3300	explorer.exe	110
PID 3300 wrote to memory of 3668	3300	explorer.exe	111
PID 3300 wrote to memory of 3668	3300	explorer.exe	111
PID 3300 wrote to memory of 3668	3300	explorer.exe	111
PID 3300 wrote to memory of 4052	3300	explorer.exe	112
PID 3300 wrote to memory of 4052	3300	explorer.exe	112
PID 3300 wrote to memory of 4052	3300	explorer.exe	112
PID 3300 wrote to memory of 1488	3300	explorer.exe	113
PID 3300 wrote to memory of 1488	3300	explorer.exe	113
PID 3300 wrote to memory of 1488	3300	explorer.exe	113
PID 3300 wrote to memory of 1392	3300	explorer.exe	114

C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63cff513d52c8bd5e9f413e8524abb61JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4676
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2956
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2320
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2972
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:884
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5116
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2160
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 60253a55f623a8fbdf5dfe2f22a6f152b1614a8bb0339e17362ae706a877afba
MD5 84eaf29ffb8b364bd6cf5291920b06da
SHA1 ea3fb247fc455ec727b841fadfb94c81526885eb
SHA512 ecc253c568908ea04dbaada15f5a7ef36c94e023ccce24e221772c9c8fae7ff7596363a8769f2c0d9972e856d5dde99e9e642217b815f17268a31bbd89d038a3
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWwwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 05535bd38f8436c2bbe920ef4d3bc5a22088791340189da6ddccf1a64dc0e006
MD5 139b7706c9ed83ffc7c77ceb30a5166d
SHA1 3549d502f17f6fdc7c7bf0ce622a55106fb6ab51
SHA512 6142da1480f495d67aeb8b8a0ab0ad3584afd06b639e01669bcc3f2bb7bdf4cfbbbd2345c449c1615e247d7972b9cbdc8873a36d30a52207edb5c6fa7257b550
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-3815-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/448-4767-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/452-1227-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/804-1414-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/856-4363-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-3583-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-3500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/932-5707-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/960-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-3419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1156-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1156-74-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1268-2141-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1276-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-3185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-3182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1308-5013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1308-5016-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1324-2237-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1360-2239-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1360-989-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1392-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1432-2236-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1488-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1596-1583-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1628-5547-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-5543-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1644-1416-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1676-2335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1680-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1740-4461-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1740-4353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2104-1742-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2124-2349-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-5146-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-4972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-2623-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2180-5409-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2184-2991-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2292-2955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2396-2551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2396-2661-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-5264-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2464-1582-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2672-3117-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2672-2941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2680-2326-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2708-2560-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2852-5893-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2952-2142-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3104-4848-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-1415-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3300-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3300-988-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3312-2323-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3312-1226-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3452-2143-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3472-3204-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3472-3200-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-2583-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3504-4992-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-2744-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3620-3805-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3620-3897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3668-1744-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3684-5527-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3792-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3860-2592-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3868-2964-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3952-2610-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4020-2305-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4024-2571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4052-1968-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4060-5536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4148-2359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-2523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-1225-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4268-2301-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4344-2764-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-2380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4560-4148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4584-4980-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4584-4984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-63-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-36-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-62-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4760-1743-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4772-2319-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4796-3193-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-5902-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4932-33-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/4932-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4932-0-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/4968-5167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5024-1413-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5048-2902-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5048-2734-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-2367-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5116-4140-0x0000000000400000-0x000000000043E000-memory.dmp

Download