pony | 84bdd689ee4c7e50dcd01801c7a5319ef88952bc8a398f66c7e097677922cb87

Analysis

max time kernel
146s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
Size 2.2MB
Sample240612-mlzersvdrn
SHA256 84bdd689ee4c7e50dcd01801c7a5319ef88952bc8a398f66c7e097677922cb87
MD5 a056ff7c264ba1afc6250ce515c56f54
SHA1 65109cc18f208598008d1e4de4e77102e478535c
SHA512 443dc32e611a534d8940387c6578aa53797328aca52d240c4779a011fd258599a57be27ab801a4b102ff557c33e31e0a9b0dbbb9613d065b0a3cbbcd697fc629
SSDEEP 49152:0UzeyQMS4DqodCnoe+iitjWwwWjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjU:02emwJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4400	explorer.exe
1284	explorer.exe
924	spoolsv.exe
4836	spoolsv.exe
1300	spoolsv.exe
2472	spoolsv.exe
2652	spoolsv.exe
2236	spoolsv.exe
3088	spoolsv.exe
4088	spoolsv.exe
2096	spoolsv.exe
3244	spoolsv.exe
1152	spoolsv.exe
1552	spoolsv.exe
3728	spoolsv.exe
2420	spoolsv.exe
2876	spoolsv.exe
3996	spoolsv.exe
4688	spoolsv.exe
3224	spoolsv.exe
3264	spoolsv.exe
3584	spoolsv.exe
3108	spoolsv.exe
4400	spoolsv.exe
1428	spoolsv.exe
772	spoolsv.exe
952	spoolsv.exe
516	spoolsv.exe
3916	spoolsv.exe
1720	spoolsv.exe
2020	spoolsv.exe
1904	spoolsv.exe
4032	spoolsv.exe
1984	spoolsv.exe
3144	spoolsv.exe
3708	spoolsv.exe
4956	spoolsv.exe
1260	spoolsv.exe
3132	explorer.exe
5020	spoolsv.exe
4900	spoolsv.exe
5096	spoolsv.exe
1996	spoolsv.exe
820	spoolsv.exe
5112	spoolsv.exe
2052	spoolsv.exe
1404	spoolsv.exe
2164	spoolsv.exe
1480	spoolsv.exe
3764	explorer.exe
1692	spoolsv.exe
4048	spoolsv.exe
1132	spoolsv.exe
612	spoolsv.exe
1072	spoolsv.exe
3188	spoolsv.exe
2392	spoolsv.exe
3876	explorer.exe
3552	spoolsv.exe
4524	spoolsv.exe
2168	spoolsv.exe
3812	spoolsv.exe
3556	spoolsv.exe
2092	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 4400 set thread context of 1284	4400	explorer.exe	93
PID 924 set thread context of 1260	924	spoolsv.exe	129
PID 4836 set thread context of 5020	4836	spoolsv.exe	131
PID 1300 set thread context of 5096	1300	spoolsv.exe	133
PID 2472 set thread context of 1996	2472	spoolsv.exe	134
PID 2652 set thread context of 820	2652	spoolsv.exe	135
PID 2236 set thread context of 5112	2236	spoolsv.exe	136
PID 3088 set thread context of 2052	3088	spoolsv.exe	137
PID 4088 set thread context of 1404	4088	spoolsv.exe	138
PID 2096 set thread context of 1480	2096	spoolsv.exe	140
PID 3244 set thread context of 1692	3244	spoolsv.exe	142
PID 1152 set thread context of 4048	1152	spoolsv.exe	143
PID 1552 set thread context of 1132	1552	spoolsv.exe	144
PID 3728 set thread context of 612	3728	spoolsv.exe	145
PID 2420 set thread context of 1072	2420	spoolsv.exe	146
PID 2876 set thread context of 2392	2876	spoolsv.exe	148
PID 3996 set thread context of 3552	3996	spoolsv.exe	150
PID 4688 set thread context of 4524	4688	spoolsv.exe	151
PID 3224 set thread context of 2168	3224	spoolsv.exe	152
PID 3264 set thread context of 3812	3264	spoolsv.exe	153
PID 3584 set thread context of 3556	3584	spoolsv.exe	154
PID 3108 set thread context of 2092	3108	spoolsv.exe	155
PID 4400 set thread context of 3632	4400	spoolsv.exe	157
PID 1428 set thread context of 3416	1428	spoolsv.exe	159
PID 772 set thread context of 3788	772	spoolsv.exe	160
PID 952 set thread context of 4236	952	spoolsv.exe	161
PID 516 set thread context of 3004	516	spoolsv.exe	162
PID 3916 set thread context of 700	3916	spoolsv.exe	163
PID 1720 set thread context of 1096	1720	spoolsv.exe	164
PID 2020 set thread context of 1432	2020	spoolsv.exe	166
PID 1904 set thread context of 2352	1904	spoolsv.exe	168
PID 4032 set thread context of 1124	4032	spoolsv.exe	169
PID 1984 set thread context of 2176	1984	spoolsv.exe	170
PID 3144 set thread context of 1508	3144	spoolsv.exe	171
PID 3708 set thread context of 1332	3708	spoolsv.exe	173
PID 4956 set thread context of 3380	4956	spoolsv.exe	175
PID 3132 set thread context of 4004	3132	explorer.exe	180
PID 4900 set thread context of 3152	4900	spoolsv.exe	182
PID 3764 set thread context of 4316	3764	explorer.exe	186
PID 2164 set thread context of 1800	2164	spoolsv.exe	187
PID 3876 set thread context of 2320	3876	explorer.exe	195
PID 3188 set thread context of 3820	3188	spoolsv.exe	197
PID 3944 set thread context of 3388	3944	explorer.exe	204
PID 4608 set thread context of 4288	4608	spoolsv.exe	205
PID 3064 set thread context of 3536	3064	spoolsv.exe	210
PID 4176 set thread context of 2972	4176	explorer.exe	212
PID 1424 set thread context of 2300	1424	spoolsv.exe	214
PID 2340 set thread context of 2536	2340	spoolsv.exe	215
PID 1756 set thread context of 2180	1756	explorer.exe	216
PID 3008 set thread context of 712	3008	spoolsv.exe	217
PID 3456 set thread context of 5004	3456	spoolsv.exe	220
PID 5068 set thread context of 3528	5068	spoolsv.exe	223
PID 4580 set thread context of 3360	4580	spoolsv.exe	225
PID 412 set thread context of 4868	412	explorer.exe	226
PID 3356 set thread context of 3500	3356	spoolsv.exe	228

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1284	explorer.exe
1260	spoolsv.exe
1260	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
1996	spoolsv.exe
1996	spoolsv.exe
820	spoolsv.exe
820	spoolsv.exe
5112	spoolsv.exe
5112	spoolsv.exe
2052	spoolsv.exe
2052	spoolsv.exe
1404	spoolsv.exe
1404	spoolsv.exe
1480	spoolsv.exe
1480	spoolsv.exe
1692	spoolsv.exe
1692	spoolsv.exe
4048	spoolsv.exe
4048	spoolsv.exe
1132	spoolsv.exe
1132	spoolsv.exe
612	spoolsv.exe
612	spoolsv.exe
1072	spoolsv.exe
1072	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
3552	spoolsv.exe
3552	spoolsv.exe
4524	spoolsv.exe
4524	spoolsv.exe
2168	spoolsv.exe
2168	spoolsv.exe
3812	spoolsv.exe
3812	spoolsv.exe
3556	spoolsv.exe
3556	spoolsv.exe
2092	spoolsv.exe
2092	spoolsv.exe
3632	spoolsv.exe
3632	spoolsv.exe
3416	spoolsv.exe
3416	spoolsv.exe
3788	spoolsv.exe
3788	spoolsv.exe
4236	spoolsv.exe
4236	spoolsv.exe
3004	spoolsv.exe
3004	spoolsv.exe
700	spoolsv.exe
700	spoolsv.exe
1096	spoolsv.exe
1096	spoolsv.exe
1432	spoolsv.exe
1432	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4284	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	81
PID 1288 wrote to memory of 4284	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	81
PID 1288 wrote to memory of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 1288 wrote to memory of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 1288 wrote to memory of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 1288 wrote to memory of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 1288 wrote to memory of 2668	1288	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	90
PID 2668 wrote to memory of 4400	2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	91
PID 2668 wrote to memory of 4400	2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	91
PID 2668 wrote to memory of 4400	2668	a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe	91
PID 4400 wrote to memory of 1284	4400	explorer.exe	93
PID 4400 wrote to memory of 1284	4400	explorer.exe	93
PID 4400 wrote to memory of 1284	4400	explorer.exe	93
PID 4400 wrote to memory of 1284	4400	explorer.exe	93
PID 4400 wrote to memory of 1284	4400	explorer.exe	93
PID 1284 wrote to memory of 924	1284	explorer.exe	94
PID 1284 wrote to memory of 924	1284	explorer.exe	94
PID 1284 wrote to memory of 924	1284	explorer.exe	94
PID 1284 wrote to memory of 4836	1284	explorer.exe	95
PID 1284 wrote to memory of 4836	1284	explorer.exe	95
PID 1284 wrote to memory of 4836	1284	explorer.exe	95
PID 1284 wrote to memory of 1300	1284	explorer.exe	96
PID 1284 wrote to memory of 1300	1284	explorer.exe	96
PID 1284 wrote to memory of 1300	1284	explorer.exe	96
PID 1284 wrote to memory of 2472	1284	explorer.exe	97
PID 1284 wrote to memory of 2472	1284	explorer.exe	97
PID 1284 wrote to memory of 2472	1284	explorer.exe	97
PID 1284 wrote to memory of 2652	1284	explorer.exe	98
PID 1284 wrote to memory of 2652	1284	explorer.exe	98
PID 1284 wrote to memory of 2652	1284	explorer.exe	98
PID 1284 wrote to memory of 2236	1284	explorer.exe	99
PID 1284 wrote to memory of 2236	1284	explorer.exe	99
PID 1284 wrote to memory of 2236	1284	explorer.exe	99
PID 1284 wrote to memory of 3088	1284	explorer.exe	100
PID 1284 wrote to memory of 3088	1284	explorer.exe	100
PID 1284 wrote to memory of 3088	1284	explorer.exe	100
PID 1284 wrote to memory of 4088	1284	explorer.exe	101
PID 1284 wrote to memory of 4088	1284	explorer.exe	101
PID 1284 wrote to memory of 4088	1284	explorer.exe	101
PID 1284 wrote to memory of 2096	1284	explorer.exe	102
PID 1284 wrote to memory of 2096	1284	explorer.exe	102
PID 1284 wrote to memory of 2096	1284	explorer.exe	102
PID 1284 wrote to memory of 3244	1284	explorer.exe	103
PID 1284 wrote to memory of 3244	1284	explorer.exe	103
PID 1284 wrote to memory of 3244	1284	explorer.exe	103
PID 1284 wrote to memory of 1152	1284	explorer.exe	104
PID 1284 wrote to memory of 1152	1284	explorer.exe	104
PID 1284 wrote to memory of 1152	1284	explorer.exe	104
PID 1284 wrote to memory of 1552	1284	explorer.exe	105
PID 1284 wrote to memory of 1552	1284	explorer.exe	105
PID 1284 wrote to memory of 1552	1284	explorer.exe	105
PID 1284 wrote to memory of 3728	1284	explorer.exe	106
PID 1284 wrote to memory of 3728	1284	explorer.exe	106
PID 1284 wrote to memory of 3728	1284	explorer.exe	106
PID 1284 wrote to memory of 2420	1284	explorer.exe	107
PID 1284 wrote to memory of 2420	1284	explorer.exe	107
PID 1284 wrote to memory of 2420	1284	explorer.exe	107
PID 1284 wrote to memory of 2876	1284	explorer.exe	108
PID 1284 wrote to memory of 2876	1284	explorer.exe	108
PID 1284 wrote to memory of 2876	1284	explorer.exe	108
PID 1284 wrote to memory of 3996	1284	explorer.exe	109
PID 1284 wrote to memory of 3996	1284	explorer.exe	109
PID 1284 wrote to memory of 3996	1284	explorer.exe	109
PID 1284 wrote to memory of 4688	1284	explorer.exe	110

C:\Users\Admin\AppData\Local\Temp\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a056ff7c264ba1afc6250ce515c56f54_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3132
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3764
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3876
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3944
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4176
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:412
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3528
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3500
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 aad1905e4f56ee80815769afdb3a5abafdabca9bbe643185d057a0960c13c409
MD5 0e64ad8795d86eea7903e03101de9fcd
SHA1 9bfc17947e704ed06f2218a36d736ed98ee42d8d
SHA512 7578c7ade9792d73b4178259c2dc8f4beb6af50307f6802fe9bcdc6903e88b8746e04e842ba507fca7596e70706fdda8aa5c224b4790bfa950190e3a80f3f758
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 89fd02c1e1ef66d841944a0c49f27e3ff6c8df81e0eff6ccf8914b67e9855d86
MD5 05847ff704ebe1a19d1ea0396323c175
SHA1 48ec8f4642c2228471e1197addb3c930f31362c7
SHA512 73438084fbf6e3fb97ceb03cae1b8ecba8f22bfe00bb429f333e609ed694cdf4143c1b77d36ed0dce091f5552896eee8f7083dd9f49e4c956ea61c650de04d61
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWww9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/612-2661-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/700-3109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/712-5606-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-2380-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/820-2438-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-995-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/924-2309-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/952-2413-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1012-6056-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1096-3120-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1124-3245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1132-2650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-1600-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1260-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1288-33-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/1288-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1288-0-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/1300-1207-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1300-2416-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1404-2472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1404-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-2307-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1432-3225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1480-2618-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1480-2745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1508-3262-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1552-1838-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1692-2625-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-2630-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-4112-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-3998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1996-2424-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1996-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2052-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2060-6059-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2092-2937-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2092-2961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2096-1598-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2168-2862-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2168-2865-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-3255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2180-5387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2236-1405-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2320-4435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2352-3238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2352-3233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2392-2833-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2420-1840-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2472-1208-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2516-6041-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2652-1209-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2668-38-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2876-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2972-5249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2972-5245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3004-3099-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3088-1406-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3108-2233-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3152-3850-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-3919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3224-2037-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3244-1599-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3264-2231-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3380-3500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3380-3628-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3388-4954-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3416-3072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3416-3069-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-5904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-6018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3528-5885-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3536-5238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3552-2842-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3556-2882-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3584-2232-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3632-3158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3632-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3728-1839-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3788-3081-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3812-2873-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3820-4656-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-2035-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4004-3779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-2638-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4088-1407-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4236-3092-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-4961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-5074-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4316-3991-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4400-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4400-2306-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4688-2036-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4836-2400-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4836-996-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4868-5767-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5004-5537-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-2384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-2382-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5096-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-2448-0x0000000000400000-0x000000000043E000-memory.dmp

Download