pony | 28bf84aba08a3a2f1b04ff10569964694db9cd8f50d7e648ee5f8c42ce103da5

Analysis

max time kernel
148s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
Size 2.2MB
Sample240604-a4jqtafb91
SHA256 28bf84aba08a3a2f1b04ff10569964694db9cd8f50d7e648ee5f8c42ce103da5
MD5 932d7e09cabb5d8a8703efb75fc5e576
SHA1 e891f9641df3e362c606e71356f1f7ba5a17b969
SHA512 2f587320caa80e97150226068496f864a6612091eaadde90184aa593feb6388d9d261d77aa4d2249814e79f3e7388baa1d32baa69161703f9c587d4278ba922f
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZp:0UzeyQMS4DqodCnoe+iitjWww1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1408	explorer.exe
2816	explorer.exe
1008	spoolsv.exe
2300	spoolsv.exe
1960	spoolsv.exe
3692	spoolsv.exe
1468	spoolsv.exe
228	spoolsv.exe
3172	spoolsv.exe
4148	spoolsv.exe
1916	spoolsv.exe
1016	spoolsv.exe
976	spoolsv.exe
4136	spoolsv.exe
4784	spoolsv.exe
1452	spoolsv.exe
4512	spoolsv.exe
3132	spoolsv.exe
4804	spoolsv.exe
728	spoolsv.exe
3924	spoolsv.exe
3160	spoolsv.exe
8	spoolsv.exe
3652	spoolsv.exe
2932	spoolsv.exe
3020	spoolsv.exe
4564	spoolsv.exe
3400	spoolsv.exe
1436	spoolsv.exe
1840	spoolsv.exe
2720	spoolsv.exe
3288	spoolsv.exe
4764	spoolsv.exe
3844	spoolsv.exe
2928	spoolsv.exe
1672	spoolsv.exe
4860	explorer.exe
3800	spoolsv.exe
1240	spoolsv.exe
3396	spoolsv.exe
4752	spoolsv.exe
4200	spoolsv.exe
5068	spoolsv.exe
3212	spoolsv.exe
2424	spoolsv.exe
1912	spoolsv.exe
3868	spoolsv.exe
2352	spoolsv.exe
4588	spoolsv.exe
1360	spoolsv.exe
3140	explorer.exe
4212	spoolsv.exe
2664	spoolsv.exe
3620	spoolsv.exe
3184	spoolsv.exe
2264	spoolsv.exe
4912	explorer.exe
1144	spoolsv.exe
4960	spoolsv.exe
2888	spoolsv.exe
4904	spoolsv.exe
1728	spoolsv.exe
4720	explorer.exe
812	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 1408 set thread context of 2816	1408	explorer.exe	96
PID 1008 set thread context of 1672	1008	spoolsv.exe	130
PID 2300 set thread context of 3800	2300	spoolsv.exe	132
PID 1960 set thread context of 1240	1960	spoolsv.exe	133
PID 3692 set thread context of 3396	3692	spoolsv.exe	134
PID 1468 set thread context of 4752	1468	spoolsv.exe	135
PID 228 set thread context of 4200	228	spoolsv.exe	136
PID 3172 set thread context of 5068	3172	spoolsv.exe	137
PID 4148 set thread context of 3212	4148	spoolsv.exe	138
PID 1916 set thread context of 2424	1916	spoolsv.exe	139
PID 1016 set thread context of 1912	1016	spoolsv.exe	140
PID 976 set thread context of 3868	976	spoolsv.exe	141
PID 4136 set thread context of 4588	4136	spoolsv.exe	143
PID 4784 set thread context of 1360	4784	spoolsv.exe	144
PID 1452 set thread context of 4212	1452	spoolsv.exe	146
PID 4512 set thread context of 2664	4512	spoolsv.exe	147
PID 3132 set thread context of 3620	3132	spoolsv.exe	148
PID 4804 set thread context of 2264	4804	spoolsv.exe	150
PID 728 set thread context of 4960	728	spoolsv.exe	153
PID 3924 set thread context of 2888	3924	spoolsv.exe	154
PID 3160 set thread context of 1728	3160	spoolsv.exe	156
PID 8 set thread context of 812	8	spoolsv.exe	158
PID 3652 set thread context of 1832	3652	spoolsv.exe	159
PID 2932 set thread context of 5052	2932	spoolsv.exe	161
PID 3020 set thread context of 1616	3020	spoolsv.exe	162
PID 4564 set thread context of 1636	4564	spoolsv.exe	163
PID 3400 set thread context of 1408	3400	spoolsv.exe	165
PID 1436 set thread context of 1572	1436	spoolsv.exe	166
PID 1840 set thread context of 4980	1840	spoolsv.exe	167
PID 2720 set thread context of 1444	2720	spoolsv.exe	168
PID 3288 set thread context of 220	3288	spoolsv.exe	170
PID 4764 set thread context of 4084	4764	spoolsv.exe	171
PID 3844 set thread context of 808	3844	spoolsv.exe	173
PID 2928 set thread context of 2448	2928	spoolsv.exe	181
PID 4860 set thread context of 3136	4860	explorer.exe	183
PID 2352 set thread context of 4932	2352	spoolsv.exe	187
PID 3140 set thread context of 4704	3140	explorer.exe	189
PID 3184 set thread context of 3212	3184	spoolsv.exe	191
PID 4912 set thread context of 1560	4912	explorer.exe	193
PID 1144 set thread context of 4132	1144	spoolsv.exe	194
PID 4904 set thread context of 4632	4904	spoolsv.exe	198
PID 4720 set thread context of 4852	4720	explorer.exe	202
PID 2340 set thread context of 5112	2340	spoolsv.exe	208
PID 1388 set thread context of 1336	1388	explorer.exe	211
PID 1304 set thread context of 676	1304	spoolsv.exe	212
PID 4916 set thread context of 2944	4916	explorer.exe	213
PID 4424 set thread context of 4956	4424	spoolsv.exe	214
PID 4608 set thread context of 4948	4608	spoolsv.exe	217
PID 1828 set thread context of 4848	1828	spoolsv.exe	220
PID 1932 set thread context of 1196	1932	spoolsv.exe	221
PID 2368 set thread context of 4868	2368	spoolsv.exe	224
PID 1432 set thread context of 3168	1432	spoolsv.exe	226
PID 2424 set thread context of 4856	2424	spoolsv.exe	228
PID 4984 set thread context of 2528	4984	explorer.exe	229
PID 4064 set thread context of 3528	4064	spoolsv.exe	230
PID 1680 set thread context of 4800	1680	spoolsv.exe	232

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
1672	spoolsv.exe
1672	spoolsv.exe
3800	spoolsv.exe
3800	spoolsv.exe
1240	spoolsv.exe
1240	spoolsv.exe
3396	spoolsv.exe
3396	spoolsv.exe
4752	spoolsv.exe
4752	spoolsv.exe
4200	spoolsv.exe
4200	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
3212	spoolsv.exe
3212	spoolsv.exe
2424	spoolsv.exe
2424	spoolsv.exe
1912	spoolsv.exe
1912	spoolsv.exe
3868	spoolsv.exe
3868	spoolsv.exe
4588	spoolsv.exe
4588	spoolsv.exe
1360	spoolsv.exe
1360	spoolsv.exe
4212	spoolsv.exe
4212	spoolsv.exe
2664	spoolsv.exe
2664	spoolsv.exe
3620	spoolsv.exe
3620	spoolsv.exe
2264	spoolsv.exe
2264	spoolsv.exe
4960	spoolsv.exe
4960	spoolsv.exe
2888	spoolsv.exe
2888	spoolsv.exe
1728	spoolsv.exe
1728	spoolsv.exe
812	spoolsv.exe
812	spoolsv.exe
1832	spoolsv.exe
1832	spoolsv.exe
5052	spoolsv.exe
5052	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
1636	spoolsv.exe
1636	spoolsv.exe
1408	spoolsv.exe
1408	spoolsv.exe
1572	spoolsv.exe
1572	spoolsv.exe
4980	spoolsv.exe
4980	spoolsv.exe
1444	spoolsv.exe
1444	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4576	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	81
PID 1580 wrote to memory of 4576	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	81
PID 1580 wrote to memory of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 1580 wrote to memory of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 1580 wrote to memory of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 1580 wrote to memory of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 1580 wrote to memory of 4760	1580	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	93
PID 4760 wrote to memory of 1408	4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	94
PID 4760 wrote to memory of 1408	4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	94
PID 4760 wrote to memory of 1408	4760	932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe	94
PID 1408 wrote to memory of 2816	1408	explorer.exe	96
PID 1408 wrote to memory of 2816	1408	explorer.exe	96
PID 1408 wrote to memory of 2816	1408	explorer.exe	96
PID 1408 wrote to memory of 2816	1408	explorer.exe	96
PID 1408 wrote to memory of 2816	1408	explorer.exe	96
PID 2816 wrote to memory of 1008	2816	explorer.exe	97
PID 2816 wrote to memory of 1008	2816	explorer.exe	97
PID 2816 wrote to memory of 1008	2816	explorer.exe	97
PID 2816 wrote to memory of 2300	2816	explorer.exe	98
PID 2816 wrote to memory of 2300	2816	explorer.exe	98
PID 2816 wrote to memory of 2300	2816	explorer.exe	98
PID 2816 wrote to memory of 1960	2816	explorer.exe	99
PID 2816 wrote to memory of 1960	2816	explorer.exe	99
PID 2816 wrote to memory of 1960	2816	explorer.exe	99
PID 2816 wrote to memory of 3692	2816	explorer.exe	100
PID 2816 wrote to memory of 3692	2816	explorer.exe	100
PID 2816 wrote to memory of 3692	2816	explorer.exe	100
PID 2816 wrote to memory of 1468	2816	explorer.exe	101
PID 2816 wrote to memory of 1468	2816	explorer.exe	101
PID 2816 wrote to memory of 1468	2816	explorer.exe	101
PID 2816 wrote to memory of 228	2816	explorer.exe	102
PID 2816 wrote to memory of 228	2816	explorer.exe	102
PID 2816 wrote to memory of 228	2816	explorer.exe	102
PID 2816 wrote to memory of 3172	2816	explorer.exe	103
PID 2816 wrote to memory of 3172	2816	explorer.exe	103
PID 2816 wrote to memory of 3172	2816	explorer.exe	103
PID 2816 wrote to memory of 4148	2816	explorer.exe	104
PID 2816 wrote to memory of 4148	2816	explorer.exe	104
PID 2816 wrote to memory of 4148	2816	explorer.exe	104
PID 2816 wrote to memory of 1916	2816	explorer.exe	105
PID 2816 wrote to memory of 1916	2816	explorer.exe	105
PID 2816 wrote to memory of 1916	2816	explorer.exe	105
PID 2816 wrote to memory of 1016	2816	explorer.exe	106
PID 2816 wrote to memory of 1016	2816	explorer.exe	106
PID 2816 wrote to memory of 1016	2816	explorer.exe	106
PID 2816 wrote to memory of 976	2816	explorer.exe	107
PID 2816 wrote to memory of 976	2816	explorer.exe	107
PID 2816 wrote to memory of 976	2816	explorer.exe	107
PID 2816 wrote to memory of 4136	2816	explorer.exe	108
PID 2816 wrote to memory of 4136	2816	explorer.exe	108
PID 2816 wrote to memory of 4136	2816	explorer.exe	108
PID 2816 wrote to memory of 4784	2816	explorer.exe	109
PID 2816 wrote to memory of 4784	2816	explorer.exe	109
PID 2816 wrote to memory of 4784	2816	explorer.exe	109
PID 2816 wrote to memory of 1452	2816	explorer.exe	110
PID 2816 wrote to memory of 1452	2816	explorer.exe	110
PID 2816 wrote to memory of 1452	2816	explorer.exe	110
PID 2816 wrote to memory of 4512	2816	explorer.exe	111
PID 2816 wrote to memory of 4512	2816	explorer.exe	111
PID 2816 wrote to memory of 4512	2816	explorer.exe	111
PID 2816 wrote to memory of 3132	2816	explorer.exe	112
PID 2816 wrote to memory of 3132	2816	explorer.exe	112
PID 2816 wrote to memory of 3132	2816	explorer.exe	112
PID 2816 wrote to memory of 4804	2816	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\932d7e09cabb5d8a8703efb75fc5e576_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4760
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4860
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4912
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4720
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4084
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4132
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1196
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1600
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 3019ffaa0d902fb5864728dbcef285448e3727147eab54553dc755e73a18c474
MD5 190ad9932f2bfebcb0600c4efe2c8f07
SHA1 1146929ead5ca33798c8960f1f47c44c14035cec
SHA512 d29018e49248dfbf963c2bffcf99111892b458ea591db57d57d870ab194eb6b3dd1ac128c7d55ae57803215fabee8a9616dccee6965310d1e28b7a32d15a592b
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwM
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 4212c5f47fd2360c5370fa6aea2d44ffc2671fbc81c9bdcc43a702960f3c3407
MD5 a084de854608ecb1028e861bc2fc134e
SHA1 10f52b6c7d4d76433e5428aa0b5828a8728b0b42
SHA512 fb7549731a2633c1c93d62dcb4041c574d6608aa3dbb629c3475f043de254a52ff5d5eab4855755c26829daa7d3d99713bbf1a6b236cd6c1d18cd127dda19440
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWww7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-2207-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/228-1210-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/676-5206-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/676-5210-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/728-1976-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/808-3283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/808-3286-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/812-2873-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/976-1540-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1008-1081-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1008-2216-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1016-1409-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1196-5604-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1196-5742-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1240-2240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1240-2237-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1336-5198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1336-5196-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1360-2499-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1360-2631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1408-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1408-91-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1408-3087-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1452-1787-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1468-1209-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1560-4348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-3097-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1580-28-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1580-23-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1580-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1600-6126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1616-2978-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1636-3077-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1636-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-2215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1728-2865-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1728-3062-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1912-2310-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1916-1408-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1960-2238-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1960-1083-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2264-2659-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2300-2225-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2300-1082-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2424-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2424-2299-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-3962-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-3829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2528-5853-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-2517-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2816-90-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2816-1080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2888-2728-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2932-2227-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2944-5220-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3020-2228-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3132-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3136-3839-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-2206-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3168-5832-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3168-5965-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3172-1211-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3212-2288-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-2292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-4180-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3396-2249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3652-2214-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3692-1084-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3800-2224-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3800-2222-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3868-2321-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-2205-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4132-4462-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4148-1212-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4200-2270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-2508-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-1788-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4564-2235-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4588-2433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-4687-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-4568-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-4100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4752-2260-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4752-2257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-27-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4784-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4800-5982-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-6105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4804-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4848-5542-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-5547-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4852-4781-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-5840-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4868-5681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-4089-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-4248-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4948-5448-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-5280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-5434-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-2718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-3108-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5052-2967-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-2277-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-5099-0x0000000000400000-0x000000000043E000-memory.dmp

Download