pony | 2f9fd999fcabe0730ca789985437916aff640c47409381d507108819c58a642a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
Size 2.2MB
Sample240612-n2wt9atekh
SHA256 2f9fd999fcabe0730ca789985437916aff640c47409381d507108819c58a642a
MD5 a09396395729f7f086f03c14a4bbe852
SHA1 24a44b7b75491ae385105a0165797d6416b4a5a9
SHA512 f249772dc588e79bea676ff44235647ee4fd6a76da62f8833005661d451bd813b7d156a095173004d3a56c74fe394f6e914eaeda3d357e6cfb5eebd1a07bfe46
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2908	explorer.exe
2752	explorer.exe
3820	spoolsv.exe
868	spoolsv.exe
4604	spoolsv.exe
4252	spoolsv.exe
4064	spoolsv.exe
756	spoolsv.exe
1376	spoolsv.exe
1448	spoolsv.exe
3852	spoolsv.exe
3844	spoolsv.exe
4456	spoolsv.exe
5116	spoolsv.exe
1088	spoolsv.exe
4120	spoolsv.exe
2008	spoolsv.exe
3112	spoolsv.exe
1712	spoolsv.exe
1368	spoolsv.exe
1908	spoolsv.exe
4140	spoolsv.exe
1116	spoolsv.exe
3884	spoolsv.exe
4924	spoolsv.exe
780	spoolsv.exe
4412	spoolsv.exe
2908	spoolsv.exe
3372	spoolsv.exe
4376	spoolsv.exe
1380	spoolsv.exe
1396	spoolsv.exe
1840	spoolsv.exe
1756	spoolsv.exe
5096	explorer.exe
2992	spoolsv.exe
4060	spoolsv.exe
4196	spoolsv.exe
364	spoolsv.exe
888	spoolsv.exe
1864	spoolsv.exe
5012	spoolsv.exe
4980	spoolsv.exe
1544	spoolsv.exe
768	spoolsv.exe
4192	spoolsv.exe
3484	spoolsv.exe
4996	spoolsv.exe
3840	spoolsv.exe
400	spoolsv.exe
364	spoolsv.exe
2688	explorer.exe
3992	spoolsv.exe
3128	spoolsv.exe
2472	spoolsv.exe
1496	spoolsv.exe
812	spoolsv.exe
2500	spoolsv.exe
1316	spoolsv.exe
5072	explorer.exe
1100	spoolsv.exe
2788	spoolsv.exe
2016	spoolsv.exe
4836	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2908 set thread context of 2752	2908	explorer.exe	96
PID 3820 set thread context of 1756	3820	spoolsv.exe	128
PID 868 set thread context of 2992	868	spoolsv.exe	130
PID 4604 set thread context of 4060	4604	spoolsv.exe	131
PID 4252 set thread context of 4196	4252	spoolsv.exe	132
PID 4064 set thread context of 364	4064	spoolsv.exe	145
PID 756 set thread context of 888	756	spoolsv.exe	134
PID 1376 set thread context of 1864	1376	spoolsv.exe	135
PID 1448 set thread context of 5012	1448	spoolsv.exe	136
PID 3852 set thread context of 4980	3852	spoolsv.exe	137
PID 3844 set thread context of 1544	3844	spoolsv.exe	138
PID 4456 set thread context of 768	4456	spoolsv.exe	139
PID 5116 set thread context of 4192	5116	spoolsv.exe	140
PID 1088 set thread context of 4996	1088	spoolsv.exe	142
PID 4120 set thread context of 3840	4120	spoolsv.exe	143
PID 2008 set thread context of 400	2008	spoolsv.exe	144
PID 3112 set thread context of 364	3112	spoolsv.exe	145
PID 1712 set thread context of 3992	1712	spoolsv.exe	147
PID 1368 set thread context of 3128	1368	spoolsv.exe	148
PID 1908 set thread context of 2472	1908	spoolsv.exe	149
PID 4140 set thread context of 1496	4140	spoolsv.exe	150
PID 1116 set thread context of 812	1116	spoolsv.exe	151
PID 3884 set thread context of 1316	3884	spoolsv.exe	153
PID 4924 set thread context of 1100	4924	spoolsv.exe	155
PID 780 set thread context of 2788	780	spoolsv.exe	156
PID 4412 set thread context of 2016	4412	spoolsv.exe	157
PID 2908 set thread context of 1648	2908	spoolsv.exe	159
PID 3372 set thread context of 3116	3372	spoolsv.exe	161
PID 4376 set thread context of 948	4376	spoolsv.exe	163
PID 1380 set thread context of 4208	1380	spoolsv.exe	165
PID 1396 set thread context of 1492	1396	spoolsv.exe	166
PID 1840 set thread context of 3628	1840	spoolsv.exe	179
PID 5096 set thread context of 2556	5096	explorer.exe	182
PID 3484 set thread context of 3184	3484	spoolsv.exe	186
PID 2688 set thread context of 2864	2688	explorer.exe	188
PID 2500 set thread context of 3824	2500	spoolsv.exe	192
PID 5072 set thread context of 4784	5072	explorer.exe	194
PID 4836 set thread context of 920	4836	spoolsv.exe	196
PID 2932 set thread context of 3636	2932	explorer.exe	199
PID 5048 set thread context of 3380	5048	spoolsv.exe	201
PID 3016 set thread context of 408	3016	explorer.exe	203
PID 3812 set thread context of 184	3812	spoolsv.exe	205
PID 4108 set thread context of 3744	4108	spoolsv.exe	207
PID 4864 set thread context of 3032	4864	spoolsv.exe	208
PID 2052 set thread context of 4588	2052	spoolsv.exe	209
PID 1160 set thread context of 2340	1160	spoolsv.exe	210
PID 3124 set thread context of 3120	3124	spoolsv.exe	212
PID 1852 set thread context of 1012	1852	spoolsv.exe	214
PID 2988 set thread context of 3576	2988	spoolsv.exe	215
PID 1284 set thread context of 2904	1284	spoolsv.exe	216
PID 1528 set thread context of 4584	1528	spoolsv.exe	218
PID 232 set thread context of 3212	232	spoolsv.exe	219
PID 3908 set thread context of 3052	3908	spoolsv.exe	221

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
2752	explorer.exe
1756	spoolsv.exe
1756	spoolsv.exe
2992	spoolsv.exe
2992	spoolsv.exe
4060	spoolsv.exe
4060	spoolsv.exe
4196	spoolsv.exe
4196	spoolsv.exe
364	spoolsv.exe
364	spoolsv.exe
888	spoolsv.exe
888	spoolsv.exe
1864	spoolsv.exe
1864	spoolsv.exe
5012	spoolsv.exe
5012	spoolsv.exe
4980	spoolsv.exe
4980	spoolsv.exe
1544	spoolsv.exe
1544	spoolsv.exe
768	spoolsv.exe
768	spoolsv.exe
4192	spoolsv.exe
4192	spoolsv.exe
4996	spoolsv.exe
4996	spoolsv.exe
3840	spoolsv.exe
3840	spoolsv.exe
400	spoolsv.exe
400	spoolsv.exe
364	spoolsv.exe
364	spoolsv.exe
3992	spoolsv.exe
3992	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
2472	spoolsv.exe
2472	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
812	spoolsv.exe
812	spoolsv.exe
1316	spoolsv.exe
1316	spoolsv.exe
1100	spoolsv.exe
1100	spoolsv.exe
2788	spoolsv.exe
2788	spoolsv.exe
2016	spoolsv.exe
2016	spoolsv.exe
1648	spoolsv.exe
1648	spoolsv.exe
3116	spoolsv.exe
3116	spoolsv.exe
948	spoolsv.exe
948	spoolsv.exe
4208	spoolsv.exe
4208	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2972	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	82
PID 2944 wrote to memory of 2972	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	82
PID 2944 wrote to memory of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2944 wrote to memory of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2944 wrote to memory of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2944 wrote to memory of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2944 wrote to memory of 2120	2944	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	87
PID 2120 wrote to memory of 2908	2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	88
PID 2120 wrote to memory of 2908	2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	88
PID 2120 wrote to memory of 2908	2120	a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe	88
PID 2908 wrote to memory of 2752	2908	explorer.exe	96
PID 2908 wrote to memory of 2752	2908	explorer.exe	96
PID 2908 wrote to memory of 2752	2908	explorer.exe	96
PID 2908 wrote to memory of 2752	2908	explorer.exe	96
PID 2908 wrote to memory of 2752	2908	explorer.exe	96
PID 2752 wrote to memory of 3820	2752	explorer.exe	97
PID 2752 wrote to memory of 3820	2752	explorer.exe	97
PID 2752 wrote to memory of 3820	2752	explorer.exe	97
PID 2752 wrote to memory of 868	2752	explorer.exe	98
PID 2752 wrote to memory of 868	2752	explorer.exe	98
PID 2752 wrote to memory of 868	2752	explorer.exe	98
PID 2752 wrote to memory of 4604	2752	explorer.exe	99
PID 2752 wrote to memory of 4604	2752	explorer.exe	99
PID 2752 wrote to memory of 4604	2752	explorer.exe	99
PID 2752 wrote to memory of 4252	2752	explorer.exe	100
PID 2752 wrote to memory of 4252	2752	explorer.exe	100
PID 2752 wrote to memory of 4252	2752	explorer.exe	100
PID 2752 wrote to memory of 4064	2752	explorer.exe	101
PID 2752 wrote to memory of 4064	2752	explorer.exe	101
PID 2752 wrote to memory of 4064	2752	explorer.exe	101
PID 2752 wrote to memory of 756	2752	explorer.exe	102
PID 2752 wrote to memory of 756	2752	explorer.exe	102
PID 2752 wrote to memory of 756	2752	explorer.exe	102
PID 2752 wrote to memory of 1376	2752	explorer.exe	103
PID 2752 wrote to memory of 1376	2752	explorer.exe	103
PID 2752 wrote to memory of 1376	2752	explorer.exe	103
PID 2752 wrote to memory of 1448	2752	explorer.exe	104
PID 2752 wrote to memory of 1448	2752	explorer.exe	104
PID 2752 wrote to memory of 1448	2752	explorer.exe	104
PID 2752 wrote to memory of 3852	2752	explorer.exe	105
PID 2752 wrote to memory of 3852	2752	explorer.exe	105
PID 2752 wrote to memory of 3852	2752	explorer.exe	105
PID 2752 wrote to memory of 3844	2752	explorer.exe	106
PID 2752 wrote to memory of 3844	2752	explorer.exe	106
PID 2752 wrote to memory of 3844	2752	explorer.exe	106
PID 2752 wrote to memory of 4456	2752	explorer.exe	107
PID 2752 wrote to memory of 4456	2752	explorer.exe	107
PID 2752 wrote to memory of 4456	2752	explorer.exe	107
PID 2752 wrote to memory of 5116	2752	explorer.exe	108
PID 2752 wrote to memory of 5116	2752	explorer.exe	108
PID 2752 wrote to memory of 5116	2752	explorer.exe	108
PID 2752 wrote to memory of 1088	2752	explorer.exe	109
PID 2752 wrote to memory of 1088	2752	explorer.exe	109
PID 2752 wrote to memory of 1088	2752	explorer.exe	109
PID 2752 wrote to memory of 4120	2752	explorer.exe	110
PID 2752 wrote to memory of 4120	2752	explorer.exe	110
PID 2752 wrote to memory of 4120	2752	explorer.exe	110
PID 2752 wrote to memory of 2008	2752	explorer.exe	111
PID 2752 wrote to memory of 2008	2752	explorer.exe	111
PID 2752 wrote to memory of 2008	2752	explorer.exe	111
PID 2752 wrote to memory of 3112	2752	explorer.exe	112
PID 2752 wrote to memory of 3112	2752	explorer.exe	112
PID 2752 wrote to memory of 3112	2752	explorer.exe	112
PID 2752 wrote to memory of 1712	2752	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a09396395729f7f086f03c14a4bbe852_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2120
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5096
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2932
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3824
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:64
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 c06f1082ec3be3e6c3b865a96a22bbd2717c03a1f2f6f1669ec2152fdabbe3ad
MD5 44726ac474273df2f51c1e8fc29e92f9
SHA1 b8b6247b4f0e32b4855ffd67af3c6bff2e74b230
SHA512 78b34271b3146c13b878b005659e776d314681a90d34941cb378f26495b986d3aefb06753fa321c11e68297c6f219ef369e353980d6eb44273ffd02ecff4e008
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZK:0UzeyQMS4DqodCnoe+iitjWww+
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 c1f840faa36f1a7ffaa24122149a7b3557fd79601d9032779c6b10b05469dd6e
MD5 f99461c1fe5a72ed74d3ffd2017dffd7
SHA1 fd8ad0dcca0ea988a677f8ea8a9d2e06a6dfc87a
SHA512 eb26f359e8a43c022394522a447cbf7ae566bf0c6efc58b3532f6499eb31abc6a9b6d595f05d72804562963a063dcd3f408089361a89d13db0b77a31824f401d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/184-4683-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/364-2259-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/364-2434-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/364-1979-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-4547-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/756-1279-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/768-2036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/768-2040-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/780-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/868-1075-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/868-1948-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/888-1988-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/920-4521-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/920-4368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/948-2918-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/948-2779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1012-4878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1088-1586-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1100-2472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1100-2469-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1116-1932-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1316-2461-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1316-2593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1368-1784-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1376-1280-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1448-1281-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1492-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-2297-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1544-2030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1648-2761-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1648-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1712-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1756-1935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1756-2246-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1864-2000-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1908-1785-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1944-5223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-1692-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2016-2540-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-47-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2340-4724-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2472-2286-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2556-3785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2736-5247-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2736-5251-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-1073-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2788-2479-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2864-3993-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2904-4898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2908-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2908-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2908-1957-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2944-43-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/2944-0-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/2944-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2944-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2992-1949-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2992-1947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3032-4702-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-5047-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-5044-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3112-1693-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3116-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3116-2619-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-5011-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3128-2277-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-3963-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-4101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-5033-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3380-4645-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3380-4536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-4886-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-4889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3828-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3636-4458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3744-4691-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3820-1074-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3820-1936-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3824-4249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-2159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-2156-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3844-1418-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3852-1417-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3884-1933-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3992-2267-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4060-1958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4064-1278-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4120-1587-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4140-1931-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4192-2048-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4196-1970-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4208-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4252-1077-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4412-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4456-1419-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4604-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4784-4260-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-1934-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4980-2018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-2058-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-2007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-2010-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5116-1585-0x0000000000400000-0x00000000005D3000-memory.dmp

Download