pony | e628905ba905f1021e2ce1f39f5d60d5e3b7136bc3e1877b3bb05f4895d11122

Analysis

max time kernel
144s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
Size 2.2MB
Sample240612-rb2vcs1enm
SHA256 e628905ba905f1021e2ce1f39f5d60d5e3b7136bc3e1877b3bb05f4895d11122
MD5 a0ec040442acea448eb5348ad446074e
SHA1 bd37e2307ee387b7c11c832e2183ffa44957de05
SHA512 8377dccd36398b8eff8cdd522b6e4c4ddb0c37649e40ca8b9e2ddd3f022dc549032a9b34dfb0ba0867e992af2ecb1070c335ca717111e94ac5d2a2e0e7ca38a6
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWwwT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1212	explorer.exe
644	explorer.exe
3852	spoolsv.exe
1036	spoolsv.exe
992	spoolsv.exe
5028	spoolsv.exe
5072	spoolsv.exe
3216	spoolsv.exe
3332	spoolsv.exe
4992	spoolsv.exe
3532	spoolsv.exe
4844	spoolsv.exe
2080	spoolsv.exe
3528	spoolsv.exe
4248	spoolsv.exe
1292	spoolsv.exe
3644	spoolsv.exe
2868	spoolsv.exe
4056	spoolsv.exe
4804	spoolsv.exe
4748	spoolsv.exe
2216	spoolsv.exe
1948	spoolsv.exe
4568	spoolsv.exe
3104	spoolsv.exe
1252	spoolsv.exe
4292	spoolsv.exe
4516	spoolsv.exe
3680	spoolsv.exe
1440	spoolsv.exe
3208	spoolsv.exe
616	spoolsv.exe
1884	spoolsv.exe
1836	spoolsv.exe
456	spoolsv.exe
864	spoolsv.exe
1192	spoolsv.exe
4908	spoolsv.exe
1224	explorer.exe
4500	spoolsv.exe
4584	spoolsv.exe
4348	spoolsv.exe
4468	spoolsv.exe
4032	spoolsv.exe
2504	spoolsv.exe
4424	spoolsv.exe
4952	explorer.exe
2456	spoolsv.exe
4972	spoolsv.exe
2732	spoolsv.exe
3936	spoolsv.exe
4324	spoolsv.exe
1392	spoolsv.exe
448	spoolsv.exe
1424	explorer.exe
4620	spoolsv.exe
2768	spoolsv.exe
1888	spoolsv.exe
4868	spoolsv.exe
3444	spoolsv.exe
4452	spoolsv.exe
4776	spoolsv.exe
2908	explorer.exe
2764	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 1212 set thread context of 644	1212	explorer.exe	87
PID 3852 set thread context of 4908	3852	spoolsv.exe	123
PID 1036 set thread context of 4500	1036	spoolsv.exe	125
PID 992 set thread context of 4584	992	spoolsv.exe	126
PID 5028 set thread context of 4348	5028	spoolsv.exe	127
PID 5072 set thread context of 4468	5072	spoolsv.exe	128
PID 3216 set thread context of 4032	3216	spoolsv.exe	129
PID 3332 set thread context of 4424	3332	spoolsv.exe	131
PID 4992 set thread context of 2456	4992	spoolsv.exe	133
PID 3532 set thread context of 4972	3532	spoolsv.exe	134
PID 4844 set thread context of 2732	4844	spoolsv.exe	135
PID 2080 set thread context of 4324	2080	spoolsv.exe	137
PID 3528 set thread context of 1392	3528	spoolsv.exe	138
PID 4248 set thread context of 448	4248	spoolsv.exe	139
PID 1292 set thread context of 4620	1292	spoolsv.exe	141
PID 3644 set thread context of 2768	3644	spoolsv.exe	142
PID 2868 set thread context of 1888	2868	spoolsv.exe	143
PID 4056 set thread context of 4868	4056	spoolsv.exe	144
PID 4804 set thread context of 4452	4804	spoolsv.exe	146
PID 4748 set thread context of 4776	4748	spoolsv.exe	147
PID 2216 set thread context of 2764	2216	spoolsv.exe	149
PID 1948 set thread context of 1380	1948	spoolsv.exe	150
PID 4568 set thread context of 2780	4568	spoolsv.exe	151
PID 3104 set thread context of 2524	3104	spoolsv.exe	153
PID 1252 set thread context of 892	1252	spoolsv.exe	155
PID 4292 set thread context of 796	4292	spoolsv.exe	156
PID 4516 set thread context of 3404	4516	spoolsv.exe	157
PID 3680 set thread context of 4480	3680	spoolsv.exe	158
PID 1440 set thread context of 3180	1440	spoolsv.exe	159
PID 3208 set thread context of 4504	3208	spoolsv.exe	162
PID 616 set thread context of 3884	616	spoolsv.exe	163
PID 1884 set thread context of 1028	1884	spoolsv.exe	164
PID 1836 set thread context of 876	1836	spoolsv.exe	165
PID 456 set thread context of 436	456	spoolsv.exe	167
PID 864 set thread context of 4276	864	spoolsv.exe	169
PID 1192 set thread context of 952	1192	spoolsv.exe	173
PID 1224 set thread context of 852	1224	explorer.exe	175
PID 2504 set thread context of 768	2504	spoolsv.exe	179
PID 4952 set thread context of 5064	4952	explorer.exe	182
PID 3936 set thread context of 2000	3936	spoolsv.exe	186
PID 1424 set thread context of 4224	1424	explorer.exe	189
PID 3444 set thread context of 3816	3444	spoolsv.exe	191
PID 2908 set thread context of 2380	2908	explorer.exe	194
PID 3328 set thread context of 3968	3328	explorer.exe	198
PID 1356 set thread context of 1552	1356	spoolsv.exe	199
PID 2888 set thread context of 1916	2888	spoolsv.exe	204
PID 1592 set thread context of 392	1592	explorer.exe	206
PID 3448 set thread context of 3312	3448	spoolsv.exe	209
PID 2008 set thread context of 4132	2008	explorer.exe	211
PID 4556 set thread context of 2184	4556	spoolsv.exe	212
PID 5004 set thread context of 3960	5004	spoolsv.exe	214
PID 4288 set thread context of 1984	4288	spoolsv.exe	217
PID 4456 set thread context of 3080	4456	explorer.exe	219
PID 3304 set thread context of 2272	3304	spoolsv.exe	221
PID 684 set thread context of 4048	684	spoolsv.exe	223

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
644	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
644	explorer.exe
4908	spoolsv.exe
4908	spoolsv.exe
4500	spoolsv.exe
4500	spoolsv.exe
4584	spoolsv.exe
4584	spoolsv.exe
4348	spoolsv.exe
4348	spoolsv.exe
4468	spoolsv.exe
4468	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
2456	spoolsv.exe
2456	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
2732	spoolsv.exe
2732	spoolsv.exe
4324	spoolsv.exe
4324	spoolsv.exe
1392	spoolsv.exe
1392	spoolsv.exe
448	spoolsv.exe
448	spoolsv.exe
4620	spoolsv.exe
4620	spoolsv.exe
2768	spoolsv.exe
2768	spoolsv.exe
1888	spoolsv.exe
1888	spoolsv.exe
4868	spoolsv.exe
4868	spoolsv.exe
4452	spoolsv.exe
4452	spoolsv.exe
4776	spoolsv.exe
4776	spoolsv.exe
2764	spoolsv.exe
2764	spoolsv.exe
1380	spoolsv.exe
1380	spoolsv.exe
2780	spoolsv.exe
2780	spoolsv.exe
2524	spoolsv.exe
2524	spoolsv.exe
892	spoolsv.exe
892	spoolsv.exe
796	spoolsv.exe
796	spoolsv.exe
3404	spoolsv.exe
3404	spoolsv.exe
4480	spoolsv.exe
4480	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
4504	spoolsv.exe
4504	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 748	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	80
PID 4296 wrote to memory of 748	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	80
PID 4296 wrote to memory of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 4296 wrote to memory of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 4296 wrote to memory of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 4296 wrote to memory of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 4296 wrote to memory of 1620	4296	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	84
PID 1620 wrote to memory of 1212	1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	85
PID 1620 wrote to memory of 1212	1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	85
PID 1620 wrote to memory of 1212	1620	a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe	85
PID 1212 wrote to memory of 644	1212	explorer.exe	87
PID 1212 wrote to memory of 644	1212	explorer.exe	87
PID 1212 wrote to memory of 644	1212	explorer.exe	87
PID 1212 wrote to memory of 644	1212	explorer.exe	87
PID 1212 wrote to memory of 644	1212	explorer.exe	87
PID 644 wrote to memory of 3852	644	explorer.exe	88
PID 644 wrote to memory of 3852	644	explorer.exe	88
PID 644 wrote to memory of 3852	644	explorer.exe	88
PID 644 wrote to memory of 1036	644	explorer.exe	89
PID 644 wrote to memory of 1036	644	explorer.exe	89
PID 644 wrote to memory of 1036	644	explorer.exe	89
PID 644 wrote to memory of 992	644	explorer.exe	90
PID 644 wrote to memory of 992	644	explorer.exe	90
PID 644 wrote to memory of 992	644	explorer.exe	90
PID 644 wrote to memory of 5028	644	explorer.exe	91
PID 644 wrote to memory of 5028	644	explorer.exe	91
PID 644 wrote to memory of 5028	644	explorer.exe	91
PID 644 wrote to memory of 5072	644	explorer.exe	92
PID 644 wrote to memory of 5072	644	explorer.exe	92
PID 644 wrote to memory of 5072	644	explorer.exe	92
PID 644 wrote to memory of 3216	644	explorer.exe	93
PID 644 wrote to memory of 3216	644	explorer.exe	93
PID 644 wrote to memory of 3216	644	explorer.exe	93
PID 644 wrote to memory of 3332	644	explorer.exe	94
PID 644 wrote to memory of 3332	644	explorer.exe	94
PID 644 wrote to memory of 3332	644	explorer.exe	94
PID 644 wrote to memory of 4992	644	explorer.exe	95
PID 644 wrote to memory of 4992	644	explorer.exe	95
PID 644 wrote to memory of 4992	644	explorer.exe	95
PID 644 wrote to memory of 3532	644	explorer.exe	96
PID 644 wrote to memory of 3532	644	explorer.exe	96
PID 644 wrote to memory of 3532	644	explorer.exe	96
PID 644 wrote to memory of 4844	644	explorer.exe	97
PID 644 wrote to memory of 4844	644	explorer.exe	97
PID 644 wrote to memory of 4844	644	explorer.exe	97
PID 644 wrote to memory of 2080	644	explorer.exe	98
PID 644 wrote to memory of 2080	644	explorer.exe	98
PID 644 wrote to memory of 2080	644	explorer.exe	98
PID 644 wrote to memory of 3528	644	explorer.exe	99
PID 644 wrote to memory of 3528	644	explorer.exe	99
PID 644 wrote to memory of 3528	644	explorer.exe	99
PID 644 wrote to memory of 4248	644	explorer.exe	100
PID 644 wrote to memory of 4248	644	explorer.exe	100
PID 644 wrote to memory of 4248	644	explorer.exe	100
PID 644 wrote to memory of 1292	644	explorer.exe	101
PID 644 wrote to memory of 1292	644	explorer.exe	101
PID 644 wrote to memory of 1292	644	explorer.exe	101
PID 644 wrote to memory of 3644	644	explorer.exe	102
PID 644 wrote to memory of 3644	644	explorer.exe	102
PID 644 wrote to memory of 3644	644	explorer.exe	102
PID 644 wrote to memory of 2868	644	explorer.exe	103
PID 644 wrote to memory of 2868	644	explorer.exe	103
PID 644 wrote to memory of 2868	644	explorer.exe	103
PID 644 wrote to memory of 4056	644	explorer.exe	104

C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:748
- C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0ec040442acea448eb5348ad446074e_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1620
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1424
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3328
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2008
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:952
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:768
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3248
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2000
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1916
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3960
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1984
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 6d7a04cbf706391599aa7952d56e338e32aa560881c60aa8ee99b4754e7b748f
MD5 8a8b4ae098ab2ccb31636f4a49053367
SHA1 5c06c6c05e72367640cc05e6c82e06ba2580d386
SHA512 6c7d2b611f8672cc399df459ae9acc4d450426d6b120cf3fdfb5ce585bd2b804a17ec8f4f6cd9fe240ea5b3662538a219ba0d3e11a16a67430ee906346634bd2
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 cd119874eed9948aa5b98fad5228fc49259b25402d34095258f7b83eed0f85ea
MD5 f09a2fc2257d33f2f65a4e45283d8be6
SHA1 1c3a1dbad4b4699e6dd0af754aeaa18853ffd283
SHA512 09c19c4c1d998beef6572ba906c0107442e5ed5af53e612ca536df17577878424c9c6aa48f8d46ec3c1c4e3033cc3028312007ddf8ca23060f7b0f245048a027
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWww1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-6306-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/392-5223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/436-3525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/436-3602-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/448-2717-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-1013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/768-4195-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/768-4051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/796-3142-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-3753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-3372-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-3368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/892-3132-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/952-3743-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/992-1196-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/992-2302-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1028-3361-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1028-3357-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-1015-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1036-2291-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1064-6235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-6239-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1212-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1212-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1212-6146-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1252-2295-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1292-1804-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1380-2936-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1552-5054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1552-4956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-47-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1888-2745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1916-5218-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-2191-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2000-4544-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-4402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2080-1579-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2216-2190-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2272-5826-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2380-4711-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2456-2491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2524-3111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-2515-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-2925-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-2948-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2868-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3080-5763-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-2285-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3180-3463-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3180-3322-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-1384-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3312-5571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3312-5451-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3332-1385-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3404-3149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3404-3154-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3528-1802-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3532-1577-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3628-6024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-6027-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-2004-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3816-4804-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3816-4628-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3852-1014-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3852-2287-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3884-3347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3884-3351-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3960-5733-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3960-5590-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-2403-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-5943-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-6121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4056-2006-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4132-5460-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4224-4482-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4248-1803-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4276-3533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4276-3535-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4292-2307-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4296-43-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4296-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4296-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4296-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4348-2319-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4424-2482-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4424-2658-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-2841-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-2330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-3162-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-2296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-2297-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4504-3340-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-2284-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4584-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-2725-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-6039-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-2189-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4776-2916-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4804-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4844-1578-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4868-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4908-2286-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4908-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2502-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4992-1386-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5028-1197-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5064-4150-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5072-1198-0x0000000000400000-0x00000000005D3000-memory.dmp

Download