pony | 23fae1abda9a95668590a8ef1a6a3d25fa5660880352ca360e5b4e1137405fe1

Analysis

max time kernel
148s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
Size

2.2MB
MD5

a0eab86e21aefe4693198351c17d73fa
SHA1

fe601024cce0d5187881364172a02fec78ae412a
SHA256

23fae1abda9a95668590a8ef1a6a3d25fa5660880352ca360e5b4e1137405fe1
SHA512

67cca3a63b452cac39613190e4a5775ddfe7b29c6157c65bb8ef8f0c6347339b4d38854ea354eb07138447369dc1c46ec75120d5860648610d53e0c634e9460c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwN

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4884	explorer.exe
60	explorer.exe
3456	spoolsv.exe
5060	spoolsv.exe
4868	spoolsv.exe
1148	spoolsv.exe
2300	spoolsv.exe
3436	spoolsv.exe
644	spoolsv.exe
3620	spoolsv.exe
396	spoolsv.exe
2904	spoolsv.exe
4580	spoolsv.exe
3464	spoolsv.exe
4664	spoolsv.exe
2512	spoolsv.exe
3692	spoolsv.exe
976	spoolsv.exe
3448	spoolsv.exe
3080	spoolsv.exe
2208	spoolsv.exe
3984	spoolsv.exe
4132	spoolsv.exe
4784	spoolsv.exe
1008	spoolsv.exe
2776	spoolsv.exe
8	spoolsv.exe
2116	spoolsv.exe
724	spoolsv.exe
752	spoolsv.exe
2636	spoolsv.exe
1220	spoolsv.exe
3680	spoolsv.exe
1612	explorer.exe
4056	spoolsv.exe
4656	spoolsv.exe
1428	spoolsv.exe
3904	spoolsv.exe
3792	spoolsv.exe
3856	spoolsv.exe
4284	spoolsv.exe
860	explorer.exe
432	spoolsv.exe
428	spoolsv.exe
3328	spoolsv.exe
4876	spoolsv.exe
2348	spoolsv.exe
4184	spoolsv.exe
1392	spoolsv.exe
3948	spoolsv.exe
4308	explorer.exe
2828	spoolsv.exe
348	spoolsv.exe
4616	spoolsv.exe
3332	spoolsv.exe
5040	spoolsv.exe
1948	explorer.exe
4224	spoolsv.exe
3536	spoolsv.exe
2992	spoolsv.exe
2060	spoolsv.exe
2552	spoolsv.exe
2284	spoolsv.exe
5052	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 1520 set thread context of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 4884 set thread context of 60	4884	explorer.exe	96
PID 3456 set thread context of 3680	3456	spoolsv.exe	127
PID 5060 set thread context of 4056	5060	spoolsv.exe	129
PID 4868 set thread context of 4656	4868	spoolsv.exe	130
PID 1148 set thread context of 3904	1148	spoolsv.exe	132
PID 2300 set thread context of 3792	2300	spoolsv.exe	133
PID 3436 set thread context of 3856	3436	spoolsv.exe	134
PID 644 set thread context of 4284	644	spoolsv.exe	135
PID 3620 set thread context of 432	3620	spoolsv.exe	137
PID 396 set thread context of 3328	396	spoolsv.exe	139
PID 2904 set thread context of 4876	2904	spoolsv.exe	140
PID 4580 set thread context of 2348	4580	spoolsv.exe	141
PID 3464 set thread context of 4184	3464	spoolsv.exe	142
PID 4664 set thread context of 1392	4664	spoolsv.exe	143
PID 2512 set thread context of 3948	2512	spoolsv.exe	144
PID 3692 set thread context of 348	3692	spoolsv.exe	147
PID 976 set thread context of 4616	976	spoolsv.exe	148
PID 3448 set thread context of 3332	3448	spoolsv.exe	149
PID 3080 set thread context of 5040	3080	spoolsv.exe	150
PID 2208 set thread context of 4224	2208	spoolsv.exe	152
PID 3984 set thread context of 2992	3984	spoolsv.exe	154
PID 4132 set thread context of 2060	4132	spoolsv.exe	155
PID 4784 set thread context of 2552	4784	spoolsv.exe	156
PID 1008 set thread context of 2284	1008	spoolsv.exe	157
PID 2776 set thread context of 1760	2776	spoolsv.exe	159
PID 8 set thread context of 4908	8	spoolsv.exe	161
PID 2116 set thread context of 5104	2116	spoolsv.exe	162
PID 724 set thread context of 5024	724	spoolsv.exe	163
PID 752 set thread context of 4924	752	spoolsv.exe	165
PID 2636 set thread context of 1904	2636	spoolsv.exe	167
PID 1220 set thread context of 4912	1220	spoolsv.exe	170
PID 1612 set thread context of 4980	1612	explorer.exe	175
PID 1428 set thread context of 3176	1428	spoolsv.exe	178
PID 860 set thread context of 3956	860	explorer.exe	183
PID 428 set thread context of 2220	428	spoolsv.exe	186
PID 4308 set thread context of 2388	4308	explorer.exe	190
PID 2828 set thread context of 3700	2828	spoolsv.exe	192
PID 3536 set thread context of 3928	3536	spoolsv.exe	197
PID 1948 set thread context of 4632	1948	explorer.exe	200
PID 3708 set thread context of 2364	3708	explorer.exe	204
PID 5052 set thread context of 2256	5052	spoolsv.exe	203
PID 4952 set thread context of 2544	4952	spoolsv.exe	206
PID 4248 set thread context of 4464	4248	explorer.exe	208
PID 2112 set thread context of 4244	2112	spoolsv.exe	209
PID 3796 set thread context of 3352	3796	spoolsv.exe	210
PID 3676 set thread context of 4608	3676	explorer.exe	212
PID 4000 set thread context of 4584	4000	spoolsv.exe	213
PID 3512 set thread context of 4544	3512	spoolsv.exe	215
PID 4684 set thread context of 2820	4684	spoolsv.exe	216
PID 4596 set thread context of 4692	4596	spoolsv.exe	218
PID 3248 set thread context of 2016	3248	spoolsv.exe	220
PID 540 set thread context of 4352	540	explorer.exe	221
PID 1528 set thread context of 4996	1528	spoolsv.exe	222

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
60	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
3680	spoolsv.exe
3680	spoolsv.exe
4056	spoolsv.exe
4056	spoolsv.exe
4656	spoolsv.exe
4656	spoolsv.exe
3904	spoolsv.exe
3904	spoolsv.exe
3792	spoolsv.exe
3792	spoolsv.exe
3856	spoolsv.exe
3856	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
432	spoolsv.exe
432	spoolsv.exe
3328	spoolsv.exe
3328	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
2348	spoolsv.exe
2348	spoolsv.exe
4184	spoolsv.exe
4184	spoolsv.exe
1392	spoolsv.exe
1392	spoolsv.exe
3948	spoolsv.exe
3948	spoolsv.exe
348	spoolsv.exe
348	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe
3332	spoolsv.exe
3332	spoolsv.exe
5040	spoolsv.exe
5040	spoolsv.exe
4224	spoolsv.exe
4224	spoolsv.exe
2992	spoolsv.exe
2992	spoolsv.exe
2060	spoolsv.exe
2060	spoolsv.exe
2552	spoolsv.exe
2552	spoolsv.exe
2284	spoolsv.exe
2284	spoolsv.exe
1760	spoolsv.exe
1760	spoolsv.exe
4908	spoolsv.exe
4908	spoolsv.exe
5104	spoolsv.exe
5104	spoolsv.exe
5024	spoolsv.exe
5024	spoolsv.exe
4924	spoolsv.exe
4924	spoolsv.exe
1904	spoolsv.exe
1904	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3960	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	82
PID 1520 wrote to memory of 3960	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	82
PID 1520 wrote to memory of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 1520 wrote to memory of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 1520 wrote to memory of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 1520 wrote to memory of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 1520 wrote to memory of 3336	1520	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	87
PID 3336 wrote to memory of 4884	3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	88
PID 3336 wrote to memory of 4884	3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	88
PID 3336 wrote to memory of 4884	3336	a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe	88
PID 4884 wrote to memory of 60	4884	explorer.exe	96
PID 4884 wrote to memory of 60	4884	explorer.exe	96
PID 4884 wrote to memory of 60	4884	explorer.exe	96
PID 4884 wrote to memory of 60	4884	explorer.exe	96
PID 4884 wrote to memory of 60	4884	explorer.exe	96
PID 60 wrote to memory of 3456	60	explorer.exe	97
PID 60 wrote to memory of 3456	60	explorer.exe	97
PID 60 wrote to memory of 3456	60	explorer.exe	97
PID 60 wrote to memory of 5060	60	explorer.exe	98
PID 60 wrote to memory of 5060	60	explorer.exe	98
PID 60 wrote to memory of 5060	60	explorer.exe	98
PID 60 wrote to memory of 4868	60	explorer.exe	99
PID 60 wrote to memory of 4868	60	explorer.exe	99
PID 60 wrote to memory of 4868	60	explorer.exe	99
PID 60 wrote to memory of 1148	60	explorer.exe	100
PID 60 wrote to memory of 1148	60	explorer.exe	100
PID 60 wrote to memory of 1148	60	explorer.exe	100
PID 60 wrote to memory of 2300	60	explorer.exe	101
PID 60 wrote to memory of 2300	60	explorer.exe	101
PID 60 wrote to memory of 2300	60	explorer.exe	101
PID 60 wrote to memory of 3436	60	explorer.exe	102
PID 60 wrote to memory of 3436	60	explorer.exe	102
PID 60 wrote to memory of 3436	60	explorer.exe	102
PID 60 wrote to memory of 644	60	explorer.exe	103
PID 60 wrote to memory of 644	60	explorer.exe	103
PID 60 wrote to memory of 644	60	explorer.exe	103
PID 60 wrote to memory of 3620	60	explorer.exe	104
PID 60 wrote to memory of 3620	60	explorer.exe	104
PID 60 wrote to memory of 3620	60	explorer.exe	104
PID 60 wrote to memory of 396	60	explorer.exe	105
PID 60 wrote to memory of 396	60	explorer.exe	105
PID 60 wrote to memory of 396	60	explorer.exe	105
PID 60 wrote to memory of 2904	60	explorer.exe	106
PID 60 wrote to memory of 2904	60	explorer.exe	106
PID 60 wrote to memory of 2904	60	explorer.exe	106
PID 60 wrote to memory of 4580	60	explorer.exe	107
PID 60 wrote to memory of 4580	60	explorer.exe	107
PID 60 wrote to memory of 4580	60	explorer.exe	107
PID 60 wrote to memory of 3464	60	explorer.exe	108
PID 60 wrote to memory of 3464	60	explorer.exe	108
PID 60 wrote to memory of 3464	60	explorer.exe	108
PID 60 wrote to memory of 4664	60	explorer.exe	109
PID 60 wrote to memory of 4664	60	explorer.exe	109
PID 60 wrote to memory of 4664	60	explorer.exe	109
PID 60 wrote to memory of 2512	60	explorer.exe	110
PID 60 wrote to memory of 2512	60	explorer.exe	110
PID 60 wrote to memory of 2512	60	explorer.exe	110
PID 60 wrote to memory of 3692	60	explorer.exe	111
PID 60 wrote to memory of 3692	60	explorer.exe	111
PID 60 wrote to memory of 3692	60	explorer.exe	111
PID 60 wrote to memory of 976	60	explorer.exe	112
PID 60 wrote to memory of 976	60	explorer.exe	112
PID 60 wrote to memory of 976	60	explorer.exe	112
PID 60 wrote to memory of 3448	60	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0eab86e21aefe4693198351c17d73fa_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3336
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1612
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:860
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3708
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4248
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2256
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2172
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
d274f3f45fc61df0955f3430ff350ebb

SHA1
acbb74361bc86e909b119721c91bfd9f66ab196a

SHA256
1e060642e33f445beee3f8ddbb7fba3ba7766ee5e7014f81ee027234d9dd6db9

SHA512
0a6d91b939f883aa43038e09d01eb1e83595211668b56a9070a833527f7c65430d710e5629d60d8121967c6f1ecc9afff28822bd751826172a92293bc0dbf962

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
436e4fdb14679809938afd459c490efc

SHA1
b5fe268ae6b1ab68693c7630d2050bf90cbefc94

SHA256
4a506204d9f9d8bf15e553b40e869d4ad54eab16546c0509c779a1f8d8565d28

SHA512
930e36d34e345dd44eee4725da509317c964290a581a3c308b23499a7443f906981f9f0a1b31ce510b0d9a766e77b00cf04a5e210a8703789815ac3eefc02954

Download Submit
memory/60-860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/60-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/348-2488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-1338-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/432-2179-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/644-1196-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/976-1878-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-2076-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1148-2074-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1148-1024-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1392-2319-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1520-0-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1520-43-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1520-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1760-2858-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-5240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2172-5428-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2208-1958-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2220-4038-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2220-4140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-4788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2284-2710-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-1194-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2312-5271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2312-5268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2364-4796-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2388-4243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2512-1683-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2544-4806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-2696-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-2701-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2820-5092-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2904-1506-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2992-2679-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3080-1885-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3176-3738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3328-2248-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3332-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3336-85-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3336-47-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3336-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3336-78-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3352-5131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3352-4988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3436-1195-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3448-1879-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3456-1961-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3456-861-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3464-1508-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3620-1337-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3680-1960-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3692-1684-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3700-4328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3700-4431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3792-2086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-2098-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-2077-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3928-4655-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3928-4547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3948-2562-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3948-2394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-3940-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3984-1959-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4056-1969-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4132-1968-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4184-2309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4184-2304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-2662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-2658-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4244-4924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-2372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-2160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4352-5250-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4464-4897-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4580-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4584-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-4996-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-4999-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-4607-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4656-1990-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4664-1682-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4692-5230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-1989-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4868-1996-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4868-1023-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4876-2285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4884-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4884-91-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4912-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4924-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4924-2990-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4980-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-5256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-5260-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-2581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5060-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5060-1022-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5104-2877-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download