pony | 17d0d9feeda3adedf4ad8b095dc6846f7419cf72b73ef424eb7c7882f1f3fbdb

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
Size 2.2MB
Sample240611-e89j9avbjb
SHA256 17d0d9feeda3adedf4ad8b095dc6846f7419cf72b73ef424eb7c7882f1f3fbdb
MD5 9d0015ceb8179d6534bdc1786b5cac11
SHA1 1f378f3a7b62643b1c3c81c0ed8807f21160ff1f
SHA512 d97ace9674bbe174cae1419213c2187944dcfd3e0103e0bdb5e18f5bc98b614e05b7d179a387025424d99b7e0bae8b242637dcae80020e0c15d7ba6cf53dd5c5
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWwwF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3168	explorer.exe
436	explorer.exe
2580	spoolsv.exe
4888	spoolsv.exe
3104	spoolsv.exe
820	spoolsv.exe
3420	spoolsv.exe
1064	spoolsv.exe
3540	spoolsv.exe
3464	spoolsv.exe
4360	spoolsv.exe
3680	spoolsv.exe
2128	spoolsv.exe
4912	spoolsv.exe
4508	spoolsv.exe
2364	spoolsv.exe
4716	spoolsv.exe
3672	spoolsv.exe
3684	spoolsv.exe
3836	spoolsv.exe
2304	spoolsv.exe
3328	spoolsv.exe
2276	spoolsv.exe
3628	spoolsv.exe
3600	spoolsv.exe
1696	spoolsv.exe
1932	spoolsv.exe
4064	spoolsv.exe
688	spoolsv.exe
3868	spoolsv.exe
1644	spoolsv.exe
4708	spoolsv.exe
4644	spoolsv.exe
1248	explorer.exe
2424	spoolsv.exe
744	spoolsv.exe
5052	spoolsv.exe
4140	spoolsv.exe
2112	spoolsv.exe
4380	spoolsv.exe
2848	explorer.exe
4736	spoolsv.exe
3828	spoolsv.exe
2292	spoolsv.exe
3816	spoolsv.exe
3392	spoolsv.exe
3536	explorer.exe
636	spoolsv.exe
2116	spoolsv.exe
4572	spoolsv.exe
4188	spoolsv.exe
976	spoolsv.exe
4620	spoolsv.exe
2340	spoolsv.exe
4256	explorer.exe
2692	spoolsv.exe
4008	explorer.exe
2356	spoolsv.exe
4260	spoolsv.exe
3196	spoolsv.exe
2068	spoolsv.exe
3376	spoolsv.exe
3912	spoolsv.exe
220	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 3168 set thread context of 436	3168	explorer.exe	96
PID 2580 set thread context of 4644	2580	spoolsv.exe	127
PID 4888 set thread context of 2424	4888	spoolsv.exe	129
PID 3104 set thread context of 744	3104	spoolsv.exe	130
PID 820 set thread context of 4140	820	spoolsv.exe	132
PID 3420 set thread context of 2112	3420	spoolsv.exe	133
PID 1064 set thread context of 4380	1064	spoolsv.exe	134
PID 3540 set thread context of 4736	3540	spoolsv.exe	136
PID 3464 set thread context of 2292	3464	spoolsv.exe	138
PID 4360 set thread context of 3816	4360	spoolsv.exe	139
PID 3680 set thread context of 3392	3680	spoolsv.exe	140
PID 2128 set thread context of 636	2128	spoolsv.exe	142
PID 4912 set thread context of 2116	4912	spoolsv.exe	143
PID 4508 set thread context of 4572	4508	spoolsv.exe	144
PID 2364 set thread context of 4188	2364	spoolsv.exe	145
PID 4716 set thread context of 976	4716	spoolsv.exe	146
PID 3672 set thread context of 2340	3672	spoolsv.exe	148
PID 3684 set thread context of 2692	3684	spoolsv.exe	150
PID 3836 set thread context of 4260	3836	spoolsv.exe	153
PID 2304 set thread context of 3196	2304	spoolsv.exe	154
PID 3328 set thread context of 2068	3328	spoolsv.exe	155
PID 2276 set thread context of 3376	2276	spoolsv.exe	156
PID 3628 set thread context of 220	3628	spoolsv.exe	158
PID 3600 set thread context of 5000	3600	spoolsv.exe	160
PID 1696 set thread context of 2820	1696	spoolsv.exe	161
PID 1932 set thread context of 1476	1932	spoolsv.exe	162
PID 4064 set thread context of 2388	4064	spoolsv.exe	165
PID 688 set thread context of 4720	688	spoolsv.exe	166
PID 3868 set thread context of 3024	3868	spoolsv.exe	167
PID 1644 set thread context of 4944	1644	spoolsv.exe	169
PID 4708 set thread context of 4044	4708	spoolsv.exe	173
PID 1248 set thread context of 4404	1248	explorer.exe	176
PID 5052 set thread context of 2260	5052	spoolsv.exe	178
PID 2848 set thread context of 4792	2848	explorer.exe	182
PID 3828 set thread context of 5064	3828	spoolsv.exe	185
PID 3536 set thread context of 4664	3536	explorer.exe	187
PID 4256 set thread context of 2012	4256	explorer.exe	189
PID 4620 set thread context of 4636	4620	spoolsv.exe	190
PID 4008 set thread context of 3936	4008	explorer.exe	195
PID 2356 set thread context of 5076	2356	spoolsv.exe	196
PID 1448 set thread context of 4860	1448	explorer.exe	200
PID 3912 set thread context of 1288	3912	spoolsv.exe	202
PID 3952 set thread context of 708	3952	spoolsv.exe	206
PID 824 set thread context of 3064	824	explorer.exe	208
PID 2860 set thread context of 1440	2860	spoolsv.exe	209
PID 2188 set thread context of 3840	2188	explorer.exe	210
PID 2748 set thread context of 3588	2748	spoolsv.exe	211
PID 1660 set thread context of 2968	1660	spoolsv.exe	213
PID 2200 set thread context of 4500	2200	explorer.exe	215
PID 912 set thread context of 2368	912	spoolsv.exe	216
PID 3592 set thread context of 980	3592	spoolsv.exe	218
PID 1312 set thread context of 2272	1312	explorer.exe	219
PID 3520 set thread context of 1528	3520	spoolsv.exe	220
PID 4300 set thread context of 4216	4300	spoolsv.exe	223
PID 3008 set thread context of 4388	3008	spoolsv.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
436	explorer.exe
4644	spoolsv.exe
4644	spoolsv.exe
2424	spoolsv.exe
2424	spoolsv.exe
744	spoolsv.exe
744	spoolsv.exe
4140	spoolsv.exe
4140	spoolsv.exe
2112	spoolsv.exe
2112	spoolsv.exe
4380	spoolsv.exe
4380	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
3816	spoolsv.exe
3816	spoolsv.exe
3392	spoolsv.exe
3392	spoolsv.exe
636	spoolsv.exe
636	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
4188	spoolsv.exe
4188	spoolsv.exe
976	spoolsv.exe
976	spoolsv.exe
2340	spoolsv.exe
2340	spoolsv.exe
2692	spoolsv.exe
2692	spoolsv.exe
4260	spoolsv.exe
4260	spoolsv.exe
3196	spoolsv.exe
3196	spoolsv.exe
2068	spoolsv.exe
2068	spoolsv.exe
3376	spoolsv.exe
3376	spoolsv.exe
220	spoolsv.exe
220	spoolsv.exe
5000	spoolsv.exe
5000	spoolsv.exe
2820	spoolsv.exe
2820	spoolsv.exe
1476	spoolsv.exe
1476	spoolsv.exe
2388	spoolsv.exe
2388	spoolsv.exe
4720	spoolsv.exe
4720	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4356	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	82
PID 4180 wrote to memory of 4356	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	82
PID 4180 wrote to memory of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 4180 wrote to memory of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 4180 wrote to memory of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 4180 wrote to memory of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 4180 wrote to memory of 3184	4180	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	87
PID 3184 wrote to memory of 3168	3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	88
PID 3184 wrote to memory of 3168	3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	88
PID 3184 wrote to memory of 3168	3184	9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe	88
PID 3168 wrote to memory of 436	3168	explorer.exe	96
PID 3168 wrote to memory of 436	3168	explorer.exe	96
PID 3168 wrote to memory of 436	3168	explorer.exe	96
PID 3168 wrote to memory of 436	3168	explorer.exe	96
PID 3168 wrote to memory of 436	3168	explorer.exe	96
PID 436 wrote to memory of 2580	436	explorer.exe	97
PID 436 wrote to memory of 2580	436	explorer.exe	97
PID 436 wrote to memory of 2580	436	explorer.exe	97
PID 436 wrote to memory of 4888	436	explorer.exe	98
PID 436 wrote to memory of 4888	436	explorer.exe	98
PID 436 wrote to memory of 4888	436	explorer.exe	98
PID 436 wrote to memory of 3104	436	explorer.exe	99
PID 436 wrote to memory of 3104	436	explorer.exe	99
PID 436 wrote to memory of 3104	436	explorer.exe	99
PID 436 wrote to memory of 820	436	explorer.exe	100
PID 436 wrote to memory of 820	436	explorer.exe	100
PID 436 wrote to memory of 820	436	explorer.exe	100
PID 436 wrote to memory of 3420	436	explorer.exe	101
PID 436 wrote to memory of 3420	436	explorer.exe	101
PID 436 wrote to memory of 3420	436	explorer.exe	101
PID 436 wrote to memory of 1064	436	explorer.exe	102
PID 436 wrote to memory of 1064	436	explorer.exe	102
PID 436 wrote to memory of 1064	436	explorer.exe	102
PID 436 wrote to memory of 3540	436	explorer.exe	103
PID 436 wrote to memory of 3540	436	explorer.exe	103
PID 436 wrote to memory of 3540	436	explorer.exe	103
PID 436 wrote to memory of 3464	436	explorer.exe	104
PID 436 wrote to memory of 3464	436	explorer.exe	104
PID 436 wrote to memory of 3464	436	explorer.exe	104
PID 436 wrote to memory of 4360	436	explorer.exe	105
PID 436 wrote to memory of 4360	436	explorer.exe	105
PID 436 wrote to memory of 4360	436	explorer.exe	105
PID 436 wrote to memory of 3680	436	explorer.exe	106
PID 436 wrote to memory of 3680	436	explorer.exe	106
PID 436 wrote to memory of 3680	436	explorer.exe	106
PID 436 wrote to memory of 2128	436	explorer.exe	107
PID 436 wrote to memory of 2128	436	explorer.exe	107
PID 436 wrote to memory of 2128	436	explorer.exe	107
PID 436 wrote to memory of 4912	436	explorer.exe	108
PID 436 wrote to memory of 4912	436	explorer.exe	108
PID 436 wrote to memory of 4912	436	explorer.exe	108
PID 436 wrote to memory of 4508	436	explorer.exe	109
PID 436 wrote to memory of 4508	436	explorer.exe	109
PID 436 wrote to memory of 4508	436	explorer.exe	109
PID 436 wrote to memory of 2364	436	explorer.exe	110
PID 436 wrote to memory of 2364	436	explorer.exe	110
PID 436 wrote to memory of 2364	436	explorer.exe	110
PID 436 wrote to memory of 4716	436	explorer.exe	111
PID 436 wrote to memory of 4716	436	explorer.exe	111
PID 436 wrote to memory of 4716	436	explorer.exe	111
PID 436 wrote to memory of 3672	436	explorer.exe	112
PID 436 wrote to memory of 3672	436	explorer.exe	112
PID 436 wrote to memory of 3672	436	explorer.exe	112
PID 436 wrote to memory of 3684	436	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9d0015ceb8179d6534bdc1786b5cac11_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3184
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1248
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4008
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:824
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2188
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2200
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1312
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1528
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 acec13d8378534a04a641d561f4fb79bb29b2796e68ee64cee95b8349ea74e12
MD5 d4076affd53da198259e27769c254949
SHA1 8785978b6c7c5f2c036f19cad532eb27e9a028d3
SHA512 0c218f499fa4a6bddc60ab062472e2bf5d496ffbcfd0e8638c6d3b4ba71237a0bdaf63c61c661d77d5b223e236cfe028adfc46c10c29dfbceab0b0d0af8adc2b
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZn:0UzeyQMS4DqodCnoe+iitjWwwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 6ddd0912ef98c18cfbd18ec0722d0280fae80d475acaeb3e39d2beacf9821f8f
MD5 692321b5eb28ed20a86a218008dbaf3e
SHA1 e0fb4d6f77becc57ce6ef3d4de107be1e3d6fb59
SHA512 af5f61c2fb7a558aacaf052d64c57166eb5e5d6ae8b56e7a133755c1688572b4e407dcb87e69528f0143410822743d105c85114ec725ecf191d7d16e793de242
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWww1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-2889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/436-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/436-984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/636-2387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/708-4809-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/744-2015-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/820-1078-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/820-2089-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/976-2425-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-1180-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1288-4696-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-4571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1440-4824-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-3141-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1528-5401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2012-3955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2068-2722-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-2108-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2116-2397-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2128-1515-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2260-3556-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2260-3638-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2272-5147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2276-2014-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2292-2271-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-1993-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2340-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-2566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2364-1518-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2368-5116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2424-2004-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-1989-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2580-985-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2692-2781-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2692-2639-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2820-2917-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2968-5020-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-3080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3064-4817-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-1077-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3104-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3168-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3168-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3184-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3184-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3196-2714-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3328-2003-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3376-2732-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-2380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3420-1179-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3464-1320-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3540-1181-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3588-4844-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3672-1703-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3680-1514-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3684-1844-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3816-2282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3836-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3840-4835-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3936-4302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-3297-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-3472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4140-2098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4180-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/4180-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4180-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4180-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/4188-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-5323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-5319-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-2704-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-1321-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4380-2347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-2169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4388-5602-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-3400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-5032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4572-2406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-4032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-1994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-2153-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4664-3859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4716-1702-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4720-3070-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-2182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-2178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-3733-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4888-1999-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4888-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4912-1516-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-3221-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-3148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-2909-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-4015-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-3849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5076-4442-0x0000000000400000-0x000000000043E000-memory.dmp

Download