pony | 9bffd66640cebdc49038c4671e514a2e9156db3a76d765303dd7732559561617

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
Size 2.2MB
Sample240612-2mqlkstcpc
SHA256 9bffd66640cebdc49038c4671e514a2e9156db3a76d765303dd7732559561617
MD5 a2c04409350960a17495152b8fde640a
SHA1 4a9fbe68bc434e2b186ba801d9c9bc8b97679ecb
SHA512 3553cfe662159b58ae7ea644e0ab45f428ac3e34157b6265a53b88864156aba207d0f2bea8b2568ba081ab9f69236222e5f722fcd942ac9a621d13dab04bf6cc
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWwwU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3836	explorer.exe
4724	explorer.exe
4776	spoolsv.exe
3372	spoolsv.exe
4540	spoolsv.exe
2256	spoolsv.exe
716	spoolsv.exe
4792	spoolsv.exe
4944	spoolsv.exe
4688	spoolsv.exe
4892	spoolsv.exe
3136	spoolsv.exe
4336	spoolsv.exe
1148	spoolsv.exe
1112	spoolsv.exe
4052	spoolsv.exe
4364	spoolsv.exe
4812	spoolsv.exe
5028	spoolsv.exe
2196	spoolsv.exe
3060	spoolsv.exe
4976	spoolsv.exe
3380	spoolsv.exe
832	spoolsv.exe
1000	spoolsv.exe
3044	spoolsv.exe
5048	spoolsv.exe
3728	spoolsv.exe
2588	spoolsv.exe
1540	spoolsv.exe
1012	spoolsv.exe
3568	spoolsv.exe
644	spoolsv.exe
4548	spoolsv.exe
4436	explorer.exe
1724	spoolsv.exe
4784	spoolsv.exe
2884	spoolsv.exe
1300	spoolsv.exe
4388	spoolsv.exe
1648	spoolsv.exe
884	spoolsv.exe
2896	explorer.exe
4184	spoolsv.exe
956	spoolsv.exe
3512	spoolsv.exe
1688	spoolsv.exe
4408	spoolsv.exe
4712	explorer.exe
2148	spoolsv.exe
1480	spoolsv.exe
1856	spoolsv.exe
2324	spoolsv.exe
4604	spoolsv.exe
536	spoolsv.exe
1296	spoolsv.exe
3052	explorer.exe
364	spoolsv.exe
4100	spoolsv.exe
4588	spoolsv.exe
1172	spoolsv.exe
3976	spoolsv.exe
3352	spoolsv.exe
3724	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 3836 set thread context of 4724	3836	explorer.exe	94
PID 4776 set thread context of 4548	4776	spoolsv.exe	126
PID 3372 set thread context of 1724	3372	spoolsv.exe	128
PID 4540 set thread context of 4784	4540	spoolsv.exe	129
PID 2256 set thread context of 2884	2256	spoolsv.exe	130
PID 716 set thread context of 1300	716	spoolsv.exe	131
PID 4792 set thread context of 4388	4792	spoolsv.exe	132
PID 4944 set thread context of 884	4944	spoolsv.exe	134
PID 4688 set thread context of 4184	4688	spoolsv.exe	136
PID 4892 set thread context of 956	4892	spoolsv.exe	137
PID 3136 set thread context of 3512	3136	spoolsv.exe	138
PID 4336 set thread context of 1688	4336	spoolsv.exe	139
PID 1148 set thread context of 4408	1148	spoolsv.exe	140
PID 1112 set thread context of 1480	1112	spoolsv.exe	143
PID 4052 set thread context of 1856	4052	spoolsv.exe	144
PID 4364 set thread context of 2324	4364	spoolsv.exe	145
PID 4812 set thread context of 4604	4812	spoolsv.exe	146
PID 5028 set thread context of 1296	5028	spoolsv.exe	148
PID 2196 set thread context of 364	2196	spoolsv.exe	150
PID 3060 set thread context of 4100	3060	spoolsv.exe	151
PID 4976 set thread context of 4588	4976	spoolsv.exe	152
PID 3380 set thread context of 3976	3380	spoolsv.exe	154
PID 832 set thread context of 3352	832	spoolsv.exe	155
PID 1000 set thread context of 3724	1000	spoolsv.exe	156
PID 3044 set thread context of 1396	3044	spoolsv.exe	158
PID 5048 set thread context of 1472	5048	spoolsv.exe	160
PID 3728 set thread context of 2596	3728	spoolsv.exe	161
PID 2588 set thread context of 3304	2588	spoolsv.exe	162
PID 1540 set thread context of 4520	1540	spoolsv.exe	163
PID 1012 set thread context of 4996	1012	spoolsv.exe	166
PID 3568 set thread context of 4200	3568	spoolsv.exe	167
PID 4436 set thread context of 5016	4436	explorer.exe	171
PID 644 set thread context of 4720	644	spoolsv.exe	172
PID 2896 set thread context of 3228	2896	explorer.exe	178
PID 1648 set thread context of 5000	1648	spoolsv.exe	180
PID 2148 set thread context of 3804	2148	spoolsv.exe	185
PID 4712 set thread context of 2996	4712	explorer.exe	187
PID 536 set thread context of 3204	536	spoolsv.exe	191
PID 3052 set thread context of 2092	3052	explorer.exe	194
PID 1172 set thread context of 4268	1172	spoolsv.exe	197
PID 2140 set thread context of 1796	2140	explorer.exe	201
PID 2712 set thread context of 4652	2712	spoolsv.exe	203
PID 1192 set thread context of 4012	1192	spoolsv.exe	206
PID 3324 set thread context of 1548	3324	explorer.exe	208
PID 1484 set thread context of 4444	1484	spoolsv.exe	210
PID 3148 set thread context of 4624	3148	spoolsv.exe	211
PID 4088 set thread context of 2932	4088	spoolsv.exe	213
PID 3784 set thread context of 220	3784	spoolsv.exe	215
PID 2108 set thread context of 4024	2108	explorer.exe	216
PID 2360 set thread context of 4164	2360	spoolsv.exe	217
PID 4496 set thread context of 2300	4496	spoolsv.exe	218
PID 2152 set thread context of 3332	2152	spoolsv.exe	220
PID 4564 set thread context of 1248	4564	spoolsv.exe	222

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4724	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4724	explorer.exe
4548	spoolsv.exe
4548	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
4784	spoolsv.exe
4784	spoolsv.exe
2884	spoolsv.exe
2884	spoolsv.exe
1300	spoolsv.exe
1300	spoolsv.exe
4388	spoolsv.exe
4388	spoolsv.exe
884	spoolsv.exe
884	spoolsv.exe
4184	spoolsv.exe
4184	spoolsv.exe
956	spoolsv.exe
956	spoolsv.exe
3512	spoolsv.exe
3512	spoolsv.exe
1688	spoolsv.exe
1688	spoolsv.exe
4408	spoolsv.exe
4408	spoolsv.exe
1480	spoolsv.exe
1480	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
2324	spoolsv.exe
2324	spoolsv.exe
4604	spoolsv.exe
4604	spoolsv.exe
1296	spoolsv.exe
1296	spoolsv.exe
364	spoolsv.exe
364	spoolsv.exe
4100	spoolsv.exe
4100	spoolsv.exe
4588	spoolsv.exe
4588	spoolsv.exe
3976	spoolsv.exe
3976	spoolsv.exe
3352	spoolsv.exe
3352	spoolsv.exe
3724	spoolsv.exe
3724	spoolsv.exe
1396	spoolsv.exe
1396	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
2596	spoolsv.exe
2596	spoolsv.exe
3304	spoolsv.exe
3304	spoolsv.exe
4520	spoolsv.exe
4520	spoolsv.exe
4996	spoolsv.exe
4996	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2372	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	83
PID 5092 wrote to memory of 2372	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	83
PID 5092 wrote to memory of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 5092 wrote to memory of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 5092 wrote to memory of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 5092 wrote to memory of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 5092 wrote to memory of 3232	5092	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	85
PID 3232 wrote to memory of 3836	3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	86
PID 3232 wrote to memory of 3836	3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	86
PID 3232 wrote to memory of 3836	3232	a2c04409350960a17495152b8fde640a_JaffaCakes118.exe	86
PID 3836 wrote to memory of 4724	3836	explorer.exe	94
PID 3836 wrote to memory of 4724	3836	explorer.exe	94
PID 3836 wrote to memory of 4724	3836	explorer.exe	94
PID 3836 wrote to memory of 4724	3836	explorer.exe	94
PID 3836 wrote to memory of 4724	3836	explorer.exe	94
PID 4724 wrote to memory of 4776	4724	explorer.exe	95
PID 4724 wrote to memory of 4776	4724	explorer.exe	95
PID 4724 wrote to memory of 4776	4724	explorer.exe	95
PID 4724 wrote to memory of 3372	4724	explorer.exe	96
PID 4724 wrote to memory of 3372	4724	explorer.exe	96
PID 4724 wrote to memory of 3372	4724	explorer.exe	96
PID 4724 wrote to memory of 4540	4724	explorer.exe	97
PID 4724 wrote to memory of 4540	4724	explorer.exe	97
PID 4724 wrote to memory of 4540	4724	explorer.exe	97
PID 4724 wrote to memory of 2256	4724	explorer.exe	98
PID 4724 wrote to memory of 2256	4724	explorer.exe	98
PID 4724 wrote to memory of 2256	4724	explorer.exe	98
PID 4724 wrote to memory of 716	4724	explorer.exe	99
PID 4724 wrote to memory of 716	4724	explorer.exe	99
PID 4724 wrote to memory of 716	4724	explorer.exe	99
PID 4724 wrote to memory of 4792	4724	explorer.exe	100
PID 4724 wrote to memory of 4792	4724	explorer.exe	100
PID 4724 wrote to memory of 4792	4724	explorer.exe	100
PID 4724 wrote to memory of 4944	4724	explorer.exe	101
PID 4724 wrote to memory of 4944	4724	explorer.exe	101
PID 4724 wrote to memory of 4944	4724	explorer.exe	101
PID 4724 wrote to memory of 4688	4724	explorer.exe	102
PID 4724 wrote to memory of 4688	4724	explorer.exe	102
PID 4724 wrote to memory of 4688	4724	explorer.exe	102
PID 4724 wrote to memory of 4892	4724	explorer.exe	103
PID 4724 wrote to memory of 4892	4724	explorer.exe	103
PID 4724 wrote to memory of 4892	4724	explorer.exe	103
PID 4724 wrote to memory of 3136	4724	explorer.exe	104
PID 4724 wrote to memory of 3136	4724	explorer.exe	104
PID 4724 wrote to memory of 3136	4724	explorer.exe	104
PID 4724 wrote to memory of 4336	4724	explorer.exe	105
PID 4724 wrote to memory of 4336	4724	explorer.exe	105
PID 4724 wrote to memory of 4336	4724	explorer.exe	105
PID 4724 wrote to memory of 1148	4724	explorer.exe	106
PID 4724 wrote to memory of 1148	4724	explorer.exe	106
PID 4724 wrote to memory of 1148	4724	explorer.exe	106
PID 4724 wrote to memory of 1112	4724	explorer.exe	107
PID 4724 wrote to memory of 1112	4724	explorer.exe	107
PID 4724 wrote to memory of 1112	4724	explorer.exe	107
PID 4724 wrote to memory of 4052	4724	explorer.exe	108
PID 4724 wrote to memory of 4052	4724	explorer.exe	108
PID 4724 wrote to memory of 4052	4724	explorer.exe	108
PID 4724 wrote to memory of 4364	4724	explorer.exe	109
PID 4724 wrote to memory of 4364	4724	explorer.exe	109
PID 4724 wrote to memory of 4364	4724	explorer.exe	109
PID 4724 wrote to memory of 4812	4724	explorer.exe	110
PID 4724 wrote to memory of 4812	4724	explorer.exe	110
PID 4724 wrote to memory of 4812	4724	explorer.exe	110
PID 4724 wrote to memory of 5028	4724	explorer.exe	111

C:\Users\Admin\AppData\Local\Temp\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a2c04409350960a17495152b8fde640a_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2896
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4712
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5000
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1560
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3804
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3204
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4012
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3332
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 16033edfb55d11ea24070989ab34dca2341c4620bdf340a192f574c560a0c5fa
MD5 3fe9bb6f27c12f235162d20aef4dc7b3
SHA1 ecdf891a6419d59f9f541c04034b1205dcc149cd
SHA512 32b8c41f426b0c0ac514913e17366da33ff59e57421e8db804d5df9e4f555ebd86bbc7c02522fe97b6e523acca0a2ff2e16f7449f665879180c371b8de0ee60c
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZG:0UzeyQMS4DqodCnoe+iitjWwwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 82a1d9ad6bbba266aa0343e57c27bd377b8b1363596ebdcb23c6038e59f33927
MD5 a4fefc829e7814c9cae8332b7c8ce600
SHA1 403bd670ae9d27351256cb9f0696ff25ace80563
SHA512 6d7fa70e6364ff0a34e8f09b5fc005adf9a74dcf3d968acf783977c87a8ebcf2b27a75b5a415fe2a340403d22dc6e3fac933b6f74ec762117991db6bba2c52e9
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/716-1103-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/832-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/884-2163-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-2254-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/956-2182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/956-2185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1000-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1112-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1148-1506-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1248-5154-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1296-2715-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1296-2545-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1300-2019-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1472-2837-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1480-2366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1548-4771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1548-4766-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1688-2203-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1724-1983-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1724-1985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1724-1981-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1796-4534-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-2376-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2092-4152-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2196-1827-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2256-937-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2300-4999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2300-4996-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-2384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2596-2846-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2596-2849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2884-2009-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2884-2007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2932-4959-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2932-5122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2996-3809-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3136-1504-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3204-4009-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3228-3478-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3232-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3232-68-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3232-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3304-2879-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3304-2870-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3332-5143-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3352-2677-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3352-2673-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3372-1986-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3372-935-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3380-1980-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3512-2194-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3724-2892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3724-2737-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3804-3877-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3804-3800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3836-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3836-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3976-2666-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4012-4900-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4012-4759-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-4978-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4052-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4100-2567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4164-4987-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4184-2171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-3006-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-3003-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-4290-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-4443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4336-1505-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4364-1627-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4388-2030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4408-2523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-4841-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-3059-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-2910-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-1999-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4540-936-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-1973-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-2085-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-2576-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4624-4849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4624-4852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-4737-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-4608-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4688-1311-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4720-3359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4720-3267-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4724-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4724-793-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4776-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4776-803-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4784-1998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4784-1995-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-1104-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4812-1825-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4892-1312-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-1105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4976-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4996-2994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-3652-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-3555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5016-3254-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-1826-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5092-0-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/5092-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5092-28-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/5092-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download