pony | 2b2094eb50257113bee4d7f7a4846067343e6f5e0edff3f6775009b609e84828

Analysis

max time kernel
139s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
Size 2.2MB
Sample240612-2grxfsxaql
SHA256 2b2094eb50257113bee4d7f7a4846067343e6f5e0edff3f6775009b609e84828
MD5 a2b7a23a17fdc4aa369a125eb2bff066
SHA1 2b9b33fca82a111b39651c70b35c1a04c733ef5c
SHA512 b1b971d445ef6593ed30148c2f9dc1cc9188998351a5e721a299c7ce1a2813c0684bd8fba0496d1b320fc3fe3e92b0ffb2061a90105e0adc69f480afae17bfa3
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2084	explorer.exe
2900	explorer.exe
4104	spoolsv.exe
2844	spoolsv.exe
3500	spoolsv.exe
1868	spoolsv.exe
1940	spoolsv.exe
392	spoolsv.exe
1772	spoolsv.exe
1556	spoolsv.exe
1080	spoolsv.exe
2084	spoolsv.exe
1052	spoolsv.exe
1000	spoolsv.exe
2612	spoolsv.exe
1476	spoolsv.exe
2744	spoolsv.exe
5060	spoolsv.exe
2140	spoolsv.exe
3008	spoolsv.exe
1976	spoolsv.exe
4528	spoolsv.exe
3672	spoolsv.exe
2324	spoolsv.exe
3040	spoolsv.exe
2944	spoolsv.exe
3080	spoolsv.exe
1364	spoolsv.exe
3952	spoolsv.exe
1132	spoolsv.exe
1084	spoolsv.exe
4756	spoolsv.exe
3656	spoolsv.exe
4516	spoolsv.exe
660	spoolsv.exe
976	spoolsv.exe
4904	spoolsv.exe
980	explorer.exe
3944	spoolsv.exe
4808	spoolsv.exe
5096	spoolsv.exe
2352	spoolsv.exe
2304	spoolsv.exe
4504	spoolsv.exe
1704	spoolsv.exe
2104	spoolsv.exe
1384	spoolsv.exe
4852	explorer.exe
448	spoolsv.exe
1176	spoolsv.exe
2860	spoolsv.exe
2968	spoolsv.exe
2340	spoolsv.exe
884	spoolsv.exe
4736	explorer.exe
4908	spoolsv.exe
1708	spoolsv.exe
2700	spoolsv.exe
4704	spoolsv.exe
3984	spoolsv.exe
5020	spoolsv.exe
3988	explorer.exe
2464	spoolsv.exe
3876	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 52 IoCs

description	pid	Process	procid_target
PID 3500 set thread context of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 2084 set thread context of 2900	2084	explorer.exe	92
PID 4104 set thread context of 4904	4104	spoolsv.exe	127
PID 2844 set thread context of 3944	2844	spoolsv.exe	129
PID 3500 set thread context of 4808	3500	spoolsv.exe	130
PID 1868 set thread context of 5096	1868	spoolsv.exe	131
PID 1940 set thread context of 2352	1940	spoolsv.exe	132
PID 392 set thread context of 2304	392	spoolsv.exe	133
PID 1772 set thread context of 1704	1772	spoolsv.exe	135
PID 1556 set thread context of 2104	1556	spoolsv.exe	136
PID 1080 set thread context of 1384	1080	spoolsv.exe	137
PID 2084 set thread context of 448	2084	spoolsv.exe	139
PID 1052 set thread context of 1176	1052	spoolsv.exe	140
PID 1000 set thread context of 2968	1000	spoolsv.exe	142
PID 2612 set thread context of 2340	2612	spoolsv.exe	143
PID 1476 set thread context of 884	1476	spoolsv.exe	144
PID 2744 set thread context of 1708	2744	spoolsv.exe	147
PID 5060 set thread context of 2700	5060	spoolsv.exe	148
PID 2140 set thread context of 4704	2140	spoolsv.exe	149
PID 3008 set thread context of 3984	3008	spoolsv.exe	150
PID 1976 set thread context of 5020	1976	spoolsv.exe	151
PID 4528 set thread context of 3876	4528	spoolsv.exe	154
PID 3672 set thread context of 1912	3672	spoolsv.exe	155
PID 2324 set thread context of 4864	2324	spoolsv.exe	156
PID 3040 set thread context of 3508	3040	spoolsv.exe	157
PID 2944 set thread context of 3536	2944	spoolsv.exe	158
PID 3080 set thread context of 4520	3080	spoolsv.exe	161
PID 1364 set thread context of 2824	1364	spoolsv.exe	162
PID 3952 set thread context of 4568	3952	spoolsv.exe	163
PID 1132 set thread context of 964	1132	spoolsv.exe	164
PID 1084 set thread context of 4988	1084	spoolsv.exe	166
PID 4756 set thread context of 4632	4756	spoolsv.exe	168
PID 3656 set thread context of 4828	3656	spoolsv.exe	169
PID 4516 set thread context of 4388	4516	spoolsv.exe	170
PID 660 set thread context of 3088	660	spoolsv.exe	172
PID 976 set thread context of 4896	976	spoolsv.exe	179
PID 980 set thread context of 4692	980	explorer.exe	182
PID 4504 set thread context of 3576	4504	spoolsv.exe	184
PID 4852 set thread context of 2940	4852	explorer.exe	188
PID 2860 set thread context of 4760	2860	spoolsv.exe	189
PID 4736 set thread context of 2760	4736	explorer.exe	194
PID 4908 set thread context of 3512	4908	spoolsv.exe	195
PID 3988 set thread context of 536	3988	explorer.exe	200
PID 2464 set thread context of 2780	2464	spoolsv.exe	201
PID 3608 set thread context of 2452	3608	explorer.exe	206
PID 3028 set thread context of 3092	3028	spoolsv.exe	207
PID 3628 set thread context of 4932	3628	spoolsv.exe	211
PID 3768 set thread context of 4100	3768	explorer.exe	213
PID 2012 set thread context of 3332	2012	spoolsv.exe	214
PID 1320 set thread context of 1096	1320	explorer.exe	215
PID 1884 set thread context of 3588	1884	spoolsv.exe	216
PID 4352 set thread context of 3056	4352	spoolsv.exe	217

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
2900	explorer.exe
4904	spoolsv.exe
4904	spoolsv.exe
3944	spoolsv.exe
3944	spoolsv.exe
4808	spoolsv.exe
4808	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
2304	spoolsv.exe
2304	spoolsv.exe
1704	spoolsv.exe
1704	spoolsv.exe
2104	spoolsv.exe
2104	spoolsv.exe
1384	spoolsv.exe
1384	spoolsv.exe
448	spoolsv.exe
448	spoolsv.exe
1176	spoolsv.exe
1176	spoolsv.exe
2968	spoolsv.exe
2968	spoolsv.exe
2340	spoolsv.exe
2340	spoolsv.exe
884	spoolsv.exe
884	spoolsv.exe
1708	spoolsv.exe
1708	spoolsv.exe
2700	spoolsv.exe
2700	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
3876	spoolsv.exe
3876	spoolsv.exe
1912	spoolsv.exe
1912	spoolsv.exe
4864	spoolsv.exe
4864	spoolsv.exe
3508	spoolsv.exe
3508	spoolsv.exe
3536	spoolsv.exe
3536	spoolsv.exe
4520	spoolsv.exe
4520	spoolsv.exe
2824	spoolsv.exe
2824	spoolsv.exe
4568	spoolsv.exe
4568	spoolsv.exe
964	spoolsv.exe
964	spoolsv.exe
4988	spoolsv.exe
4988	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1988	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	82
PID 3500 wrote to memory of 1988	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	82
PID 3500 wrote to memory of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 3500 wrote to memory of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 3500 wrote to memory of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 3500 wrote to memory of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 3500 wrote to memory of 3324	3500	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	87
PID 3324 wrote to memory of 2084	3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	88
PID 3324 wrote to memory of 2084	3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	88
PID 3324 wrote to memory of 2084	3324	a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe	88
PID 2084 wrote to memory of 2900	2084	explorer.exe	92
PID 2084 wrote to memory of 2900	2084	explorer.exe	92
PID 2084 wrote to memory of 2900	2084	explorer.exe	92
PID 2084 wrote to memory of 2900	2084	explorer.exe	92
PID 2084 wrote to memory of 2900	2084	explorer.exe	92
PID 2900 wrote to memory of 4104	2900	explorer.exe	93
PID 2900 wrote to memory of 4104	2900	explorer.exe	93
PID 2900 wrote to memory of 4104	2900	explorer.exe	93
PID 2900 wrote to memory of 2844	2900	explorer.exe	94
PID 2900 wrote to memory of 2844	2900	explorer.exe	94
PID 2900 wrote to memory of 2844	2900	explorer.exe	94
PID 2900 wrote to memory of 3500	2900	explorer.exe	95
PID 2900 wrote to memory of 3500	2900	explorer.exe	95
PID 2900 wrote to memory of 3500	2900	explorer.exe	95
PID 2900 wrote to memory of 1868	2900	explorer.exe	96
PID 2900 wrote to memory of 1868	2900	explorer.exe	96
PID 2900 wrote to memory of 1868	2900	explorer.exe	96
PID 2900 wrote to memory of 1940	2900	explorer.exe	97
PID 2900 wrote to memory of 1940	2900	explorer.exe	97
PID 2900 wrote to memory of 1940	2900	explorer.exe	97
PID 2900 wrote to memory of 392	2900	explorer.exe	98
PID 2900 wrote to memory of 392	2900	explorer.exe	98
PID 2900 wrote to memory of 392	2900	explorer.exe	98
PID 2900 wrote to memory of 1772	2900	explorer.exe	99
PID 2900 wrote to memory of 1772	2900	explorer.exe	99
PID 2900 wrote to memory of 1772	2900	explorer.exe	99
PID 2900 wrote to memory of 1556	2900	explorer.exe	100
PID 2900 wrote to memory of 1556	2900	explorer.exe	100
PID 2900 wrote to memory of 1556	2900	explorer.exe	100
PID 2900 wrote to memory of 1080	2900	explorer.exe	101
PID 2900 wrote to memory of 1080	2900	explorer.exe	101
PID 2900 wrote to memory of 1080	2900	explorer.exe	101
PID 2900 wrote to memory of 2084	2900	explorer.exe	102
PID 2900 wrote to memory of 2084	2900	explorer.exe	102
PID 2900 wrote to memory of 2084	2900	explorer.exe	102
PID 2900 wrote to memory of 1052	2900	explorer.exe	103
PID 2900 wrote to memory of 1052	2900	explorer.exe	103
PID 2900 wrote to memory of 1052	2900	explorer.exe	103
PID 2900 wrote to memory of 1000	2900	explorer.exe	104
PID 2900 wrote to memory of 1000	2900	explorer.exe	104
PID 2900 wrote to memory of 1000	2900	explorer.exe	104
PID 2900 wrote to memory of 2612	2900	explorer.exe	105
PID 2900 wrote to memory of 2612	2900	explorer.exe	105
PID 2900 wrote to memory of 2612	2900	explorer.exe	105
PID 2900 wrote to memory of 1476	2900	explorer.exe	106
PID 2900 wrote to memory of 1476	2900	explorer.exe	106
PID 2900 wrote to memory of 1476	2900	explorer.exe	106
PID 2900 wrote to memory of 2744	2900	explorer.exe	107
PID 2900 wrote to memory of 2744	2900	explorer.exe	107
PID 2900 wrote to memory of 2744	2900	explorer.exe	107
PID 2900 wrote to memory of 5060	2900	explorer.exe	108
PID 2900 wrote to memory of 5060	2900	explorer.exe	108
PID 2900 wrote to memory of 5060	2900	explorer.exe	108
PID 2900 wrote to memory of 2140	2900	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a2b7a23a17fdc4aa369a125eb2bff066_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:980
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4852
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3988
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3768
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1320
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4896
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4092
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3460
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3512
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 0e9f5645ca33c2f7dcd23431833f3547cd918d99fe3d723ce412ebaeb1e9e30b
MD5 f6acebab0efd4499c08706cee02eedd5
SHA1 eb84217118e9d92f3079b4129cad77bd68238525
SHA512 fd2beb53dc382af1fbd123295826c3d7b16c558e91feb7cc0faa3fdcb4a61c7ffc43b073dc4831a2ac51a7eece8b81dc2d238364ddb0a787dcd90e70d7b6fe54
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 84a604f89c3b1e447fbd06d646a4499a003186821f658222abb425d5636c8a23
MD5 72afb296b52f76db574cbb833fea2480
SHA1 cbdf77c8191fd0f674ed171538df189386c0f91e
SHA512 f94c18cb1ff3c40a6a7b8318ff54c23c37d6d30de539cf2aa943d5ccdceb6044744f04d315eeb2aff91ead720dc099e3ecb5121ed738f919835a9ba1d0373844
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWww4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-1375-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/448-2579-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/536-4922-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/744-5689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-2940-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1000-1823-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1044-6111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-1630-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1080-1628-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1096-5506-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-2741-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-2571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-1830-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1556-1377-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1704-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1704-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1708-2855-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-1376-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1868-1183-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1912-3063-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1940-1374-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1976-2242-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-1629-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2104-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2140-2044-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2304-2401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-2348-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2340-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2352-2391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-5222-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-1824-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2700-2866-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2700-2862-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2708-5962-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-2039-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2760-4619-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-4931-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-5054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-2360-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2844-1181-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2900-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2900-979-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2940-4305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-2364-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2968-2682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3008-2241-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3040-2357-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3056-5513-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3088-3615-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3088-3677-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3092-5360-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-77-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3324-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-31-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3332-5483-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3332-5487-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3500-2365-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3500-28-0x0000000002350000-0x0000000002351000-memory.dmp

Download

memory/3500-0-0x0000000002350000-0x0000000002351000-memory.dmp

Download

memory/3500-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3500-1182-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3508-3082-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-4627-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-4755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3536-3170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3536-3325-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-4212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-4102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3588-5499-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3672-2347-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3876-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3876-3054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-2358-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-2884-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-5475-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4104-980-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4104-2343-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4312-5949-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-6117-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-6122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4388-3452-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4388-3456-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-3219-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4528-2243-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-5669-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-3236-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4692-4040-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-2877-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-4311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-4436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4808-2371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-3439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-3072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-3901-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-4005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4900-5973-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4900-5970-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-2349-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-2543-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-6103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-5465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-3117-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5060-2040-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5088-5941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5096-2382-0x0000000000400000-0x000000000043E000-memory.dmp

Download