pony | a3702720bcdb4d8ab926b228011b6d87ca15e98f8b513adb4c7246ca3abc0f78

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
Size 2.2MB
Sample240603-wbcyfsfc34
SHA256 a3702720bcdb4d8ab926b228011b6d87ca15e98f8b513adb4c7246ca3abc0f78
MD5 92a643fa19f7126e3a6c63b1c8a740de
SHA1 403d4d9930f46a5f99f7e86a5bc74bfbee3c14b7
SHA512 73fd7bcf0481bc52e2f1de9d227d45aa64617c9bc4695490d4e62d532bd6131e221d376f01659f62179b505e3e48c2a3afae69c48d98dbd87be44dc168a0aafa
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3952	explorer.exe
4132	explorer.exe
3416	spoolsv.exe
2356	spoolsv.exe
3884	spoolsv.exe
1160	spoolsv.exe
4396	spoolsv.exe
316	spoolsv.exe
2496	spoolsv.exe
3196	spoolsv.exe
3048	spoolsv.exe
2440	spoolsv.exe
2644	spoolsv.exe
1408	spoolsv.exe
3476	spoolsv.exe
512	spoolsv.exe
464	spoolsv.exe
4840	spoolsv.exe
4764	spoolsv.exe
3140	spoolsv.exe
4068	spoolsv.exe
3132	spoolsv.exe
4884	spoolsv.exe
3900	spoolsv.exe
1032	spoolsv.exe
1792	spoolsv.exe
5080	spoolsv.exe
864	spoolsv.exe
4520	spoolsv.exe
924	spoolsv.exe
2592	spoolsv.exe
3824	spoolsv.exe
1436	spoolsv.exe
4604	spoolsv.exe
4556	spoolsv.exe
708	explorer.exe
3420	spoolsv.exe
4872	spoolsv.exe
2976	spoolsv.exe
1660	spoolsv.exe
3228	spoolsv.exe
3192	spoolsv.exe
4744	explorer.exe
3680	spoolsv.exe
452	spoolsv.exe
828	spoolsv.exe
3988	spoolsv.exe
3316	spoolsv.exe
684	spoolsv.exe
1152	explorer.exe
892	spoolsv.exe
2580	spoolsv.exe
4736	spoolsv.exe
2556	spoolsv.exe
2148	spoolsv.exe
3484	spoolsv.exe
736	spoolsv.exe
4024	spoolsv.exe
3828	spoolsv.exe
3200	explorer.exe
2812	spoolsv.exe
3208	spoolsv.exe
3408	spoolsv.exe
1116	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 53 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 3952 set thread context of 4132	3952	explorer.exe	99
PID 3416 set thread context of 4604	3416	spoolsv.exe	131
PID 2356 set thread context of 3420	2356	spoolsv.exe	134
PID 3884 set thread context of 4872	3884	spoolsv.exe	135
PID 1160 set thread context of 2976	1160	spoolsv.exe	136
PID 4396 set thread context of 3228	4396	spoolsv.exe	138
PID 316 set thread context of 3192	316	spoolsv.exe	139
PID 2496 set thread context of 3680	2496	spoolsv.exe	141
PID 3196 set thread context of 452	3196	spoolsv.exe	142
PID 3048 set thread context of 828	3048	spoolsv.exe	143
PID 2440 set thread context of 3316	2440	spoolsv.exe	145
PID 2644 set thread context of 684	2644	spoolsv.exe	146
PID 1408 set thread context of 892	1408	spoolsv.exe	148
PID 3476 set thread context of 2580	3476	spoolsv.exe	163
PID 512 set thread context of 4736	512	spoolsv.exe	150
PID 464 set thread context of 2556	464	spoolsv.exe	151
PID 4840 set thread context of 2148	4840	spoolsv.exe	152
PID 4764 set thread context of 3484	4764	spoolsv.exe	153
PID 3140 set thread context of 4024	3140	spoolsv.exe	155
PID 4068 set thread context of 3828	4068	spoolsv.exe	156
PID 3132 set thread context of 2812	3132	spoolsv.exe	158
PID 4884 set thread context of 3208	4884	spoolsv.exe	159
PID 3900 set thread context of 3408	3900	spoolsv.exe	160
PID 1032 set thread context of 3740	1032	spoolsv.exe	162
PID 1792 set thread context of 2580	1792	spoolsv.exe	163
PID 5080 set thread context of 224	5080	spoolsv.exe	164
PID 864 set thread context of 2244	864	spoolsv.exe	167
PID 4520 set thread context of 3024	4520	spoolsv.exe	168
PID 924 set thread context of 832	924	spoolsv.exe	169
PID 2592 set thread context of 3644	2592	spoolsv.exe	171
PID 3824 set thread context of 2292	3824	spoolsv.exe	173
PID 1436 set thread context of 1632	1436	spoolsv.exe	175
PID 4556 set thread context of 540	4556	spoolsv.exe	179
PID 708 set thread context of 3836	708	explorer.exe	182
PID 1660 set thread context of 3432	1660	spoolsv.exe	185
PID 4744 set thread context of 1576	4744	explorer.exe	188
PID 3988 set thread context of 1444	3988	spoolsv.exe	193
PID 1152 set thread context of 1056	1152	explorer.exe	197
PID 736 set thread context of 4996	736	spoolsv.exe	200
PID 3200 set thread context of 344	3200	explorer.exe	203
PID 1116 set thread context of 936	1116	spoolsv.exe	204
PID 3776 set thread context of 1620	3776	explorer.exe	208
PID 1008 set thread context of 3052	1008	spoolsv.exe	209
PID 4180 set thread context of 3904	4180	explorer.exe	213
PID 1608 set thread context of 3548	1608	spoolsv.exe	214
PID 3816 set thread context of 184	3816	spoolsv.exe	216
PID 2468 set thread context of 4040	2468	explorer.exe	217
PID 4936 set thread context of 2972	4936	spoolsv.exe	218
PID 768 set thread context of 1840	768	spoolsv.exe	220
PID 636 set thread context of 1972	636	explorer.exe	222
PID 3040 set thread context of 2568	3040	spoolsv.exe	223
PID 1392 set thread context of 3760	1392	spoolsv.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4132	explorer.exe
4604	spoolsv.exe
4604	spoolsv.exe
3420	spoolsv.exe
3420	spoolsv.exe
4872	spoolsv.exe
4872	spoolsv.exe
2976	spoolsv.exe
2976	spoolsv.exe
3228	spoolsv.exe
3228	spoolsv.exe
3192	spoolsv.exe
3192	spoolsv.exe
3680	spoolsv.exe
3680	spoolsv.exe
452	spoolsv.exe
452	spoolsv.exe
828	spoolsv.exe
828	spoolsv.exe
3316	spoolsv.exe
3316	spoolsv.exe
684	spoolsv.exe
684	spoolsv.exe
892	spoolsv.exe
892	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
2556	spoolsv.exe
2556	spoolsv.exe
2148	spoolsv.exe
2148	spoolsv.exe
3484	spoolsv.exe
3484	spoolsv.exe
4024	spoolsv.exe
4024	spoolsv.exe
3828	spoolsv.exe
3828	spoolsv.exe
2812	spoolsv.exe
2812	spoolsv.exe
3208	spoolsv.exe
3208	spoolsv.exe
3408	spoolsv.exe
3408	spoolsv.exe
3740	spoolsv.exe
3740	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
224	spoolsv.exe
224	spoolsv.exe
2244	spoolsv.exe
2244	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
832	spoolsv.exe
832	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2804	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	84
PID 1576 wrote to memory of 2804	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	84
PID 1576 wrote to memory of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 1576 wrote to memory of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 1576 wrote to memory of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 1576 wrote to memory of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 1576 wrote to memory of 4312	1576	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	96
PID 4312 wrote to memory of 3952	4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	97
PID 4312 wrote to memory of 3952	4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	97
PID 4312 wrote to memory of 3952	4312	92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe	97
PID 3952 wrote to memory of 4132	3952	explorer.exe	99
PID 3952 wrote to memory of 4132	3952	explorer.exe	99
PID 3952 wrote to memory of 4132	3952	explorer.exe	99
PID 3952 wrote to memory of 4132	3952	explorer.exe	99
PID 3952 wrote to memory of 4132	3952	explorer.exe	99
PID 4132 wrote to memory of 3416	4132	explorer.exe	100
PID 4132 wrote to memory of 3416	4132	explorer.exe	100
PID 4132 wrote to memory of 3416	4132	explorer.exe	100
PID 4132 wrote to memory of 2356	4132	explorer.exe	101
PID 4132 wrote to memory of 2356	4132	explorer.exe	101
PID 4132 wrote to memory of 2356	4132	explorer.exe	101
PID 4132 wrote to memory of 3884	4132	explorer.exe	102
PID 4132 wrote to memory of 3884	4132	explorer.exe	102
PID 4132 wrote to memory of 3884	4132	explorer.exe	102
PID 4132 wrote to memory of 1160	4132	explorer.exe	103
PID 4132 wrote to memory of 1160	4132	explorer.exe	103
PID 4132 wrote to memory of 1160	4132	explorer.exe	103
PID 4132 wrote to memory of 4396	4132	explorer.exe	104
PID 4132 wrote to memory of 4396	4132	explorer.exe	104
PID 4132 wrote to memory of 4396	4132	explorer.exe	104
PID 4132 wrote to memory of 316	4132	explorer.exe	105
PID 4132 wrote to memory of 316	4132	explorer.exe	105
PID 4132 wrote to memory of 316	4132	explorer.exe	105
PID 4132 wrote to memory of 2496	4132	explorer.exe	106
PID 4132 wrote to memory of 2496	4132	explorer.exe	106
PID 4132 wrote to memory of 2496	4132	explorer.exe	106
PID 4132 wrote to memory of 3196	4132	explorer.exe	107
PID 4132 wrote to memory of 3196	4132	explorer.exe	107
PID 4132 wrote to memory of 3196	4132	explorer.exe	107
PID 4132 wrote to memory of 3048	4132	explorer.exe	108
PID 4132 wrote to memory of 3048	4132	explorer.exe	108
PID 4132 wrote to memory of 3048	4132	explorer.exe	108
PID 4132 wrote to memory of 2440	4132	explorer.exe	109
PID 4132 wrote to memory of 2440	4132	explorer.exe	109
PID 4132 wrote to memory of 2440	4132	explorer.exe	109
PID 4132 wrote to memory of 2644	4132	explorer.exe	110
PID 4132 wrote to memory of 2644	4132	explorer.exe	110
PID 4132 wrote to memory of 2644	4132	explorer.exe	110
PID 4132 wrote to memory of 1408	4132	explorer.exe	111
PID 4132 wrote to memory of 1408	4132	explorer.exe	111
PID 4132 wrote to memory of 1408	4132	explorer.exe	111
PID 4132 wrote to memory of 3476	4132	explorer.exe	112
PID 4132 wrote to memory of 3476	4132	explorer.exe	112
PID 4132 wrote to memory of 3476	4132	explorer.exe	112
PID 4132 wrote to memory of 512	4132	explorer.exe	113
PID 4132 wrote to memory of 512	4132	explorer.exe	113
PID 4132 wrote to memory of 512	4132	explorer.exe	113
PID 4132 wrote to memory of 464	4132	explorer.exe	114
PID 4132 wrote to memory of 464	4132	explorer.exe	114
PID 4132 wrote to memory of 464	4132	explorer.exe	114
PID 4132 wrote to memory of 4840	4132	explorer.exe	115
PID 4132 wrote to memory of 4840	4132	explorer.exe	115
PID 4132 wrote to memory of 4840	4132	explorer.exe	115
PID 4132 wrote to memory of 4764	4132	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\92a643fa19f7126e3a6c63b1c8a740de_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4312
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:708
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4744
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3200
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3776
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4180
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2468
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:636
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:936
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1840
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 39ce3b4538f9e0861d7d90bd0dfd47efd76aeb363179697a2b01f7e13e5ee2bf
MD5 5960622de0933e3eb140eb74755b960b
SHA1 55ec5b25c514a5c8464eca70991d6995b0f52783
SHA512 92c7b51703196322498a8a91d5c19551d6b0c16cecb66f606852638742501d20bfba18bcf01c87088dccdeac0f528a71a5830279080095c505cafde9348d79b4
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 d9b74adbe9c52e8efb8c96f6856f2aabca1839034d84df2c68fc2de6dc38415d
MD5 81c82b3f21f72e8c93c07ab540536c7c
SHA1 07fd5c5e70e08afaf351e4d1876bc172364a5c54
SHA512 ed1c26da6611122ee85ee3c3799bce2d2f1684f5d9d2f10c321a3f631625a22fa98e208704890de27080ec30d640e41d81d67bf34dc1e6bc59ff63f63ff24f6c
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/184-5103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/184-5099-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-3109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/316-1268-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/452-2341-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/452-2337-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/464-1797-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/512-1796-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/540-3704-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-3551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/684-2531-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/828-2349-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/832-3082-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/892-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/936-4869-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/936-4806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1004-5474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1032-2169-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1056-4465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1160-1081-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1408-1651-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1444-4256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1444-4384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1576-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1576-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1576-0-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1576-3972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1576-43-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1620-4887-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1632-3452-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1792-2195-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1840-5372-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1840-5244-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1972-5253-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2148-2579-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-3064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2292-3210-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2356-2160-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2356-1079-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2440-1477-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2496-1269-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2556-2569-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2568-5261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2568-5265-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-2548-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-2887-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-2892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-1650-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2812-2771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2976-2188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3048-1476-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3052-4975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-5663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-5667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3132-2136-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3140-1998-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3192-2497-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-2316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3196-1475-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3208-2780-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3228-2255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3408-2791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3416-2139-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3416-893-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3420-2158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3432-3856-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3476-1795-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3484-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3548-5092-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-3263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3680-2330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3740-2881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3760-5396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3760-5569-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3828-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3836-3646-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3884-2165-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3884-1080-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3900-2157-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3904-5083-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3952-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3952-99-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3972-5562-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-2672-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-2668-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4040-5114-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4040-5111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4068-1999-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4132-98-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4132-892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-1267-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-5574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-5795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4604-2299-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4604-2140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-2562-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4764-1997-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4840-1798-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4872-2170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4884-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4996-4722-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-4584-0x0000000000400000-0x000000000043E000-memory.dmp

Download