pony | dcd62b336933551d5044c2552e2a7259eaea4bc02f0318869eb345ab79f722c7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
Size 2.2MB
Sample240612-t86wpawarr
SHA256 dcd62b336933551d5044c2552e2a7259eaea4bc02f0318869eb345ab79f722c7
MD5 a16222ed5b1a35ae606e22ccd0b92b9f
SHA1 292ca153122b9c30dc9718f52f17a48058512388
SHA512 8583d3138ff9326fab4e89c4ad0fe151ee4643efbcb8521717f9eb9756076715d94d487fc9fab1599c3cc787239007250d031fe3551c97320ed8235e1e59df07
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWww+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1316	explorer.exe
4464	explorer.exe
2992	spoolsv.exe
3584	spoolsv.exe
1516	spoolsv.exe
4000	spoolsv.exe
3512	spoolsv.exe
4120	spoolsv.exe
3492	spoolsv.exe
3504	spoolsv.exe
1464	spoolsv.exe
1968	spoolsv.exe
5112	spoolsv.exe
1664	spoolsv.exe
3848	spoolsv.exe
2328	spoolsv.exe
1856	spoolsv.exe
2472	spoolsv.exe
3772	spoolsv.exe
4080	spoolsv.exe
3036	spoolsv.exe
1748	spoolsv.exe
1836	spoolsv.exe
3904	spoolsv.exe
3588	spoolsv.exe
2796	spoolsv.exe
2440	spoolsv.exe
4964	spoolsv.exe
1644	spoolsv.exe
2080	spoolsv.exe
688	spoolsv.exe
668	spoolsv.exe
2496	spoolsv.exe
2928	spoolsv.exe
3684	spoolsv.exe
908	spoolsv.exe
4376	spoolsv.exe
4084	spoolsv.exe
4312	spoolsv.exe
5048	explorer.exe
3208	spoolsv.exe
5056	spoolsv.exe
4944	spoolsv.exe
2456	spoolsv.exe
2476	spoolsv.exe
4860	spoolsv.exe
4352	spoolsv.exe
4412	spoolsv.exe
3556	explorer.exe
4364	spoolsv.exe
2108	spoolsv.exe
772	spoolsv.exe
4212	spoolsv.exe
3424	spoolsv.exe
3152	spoolsv.exe
4508	spoolsv.exe
3912	explorer.exe
4688	spoolsv.exe
1492	spoolsv.exe
4308	spoolsv.exe
4052	spoolsv.exe
4896	spoolsv.exe
1152	spoolsv.exe
1004	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 60 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 1316 set thread context of 4464	1316	explorer.exe	92
PID 2992 set thread context of 4312	2992	spoolsv.exe	129
PID 3584 set thread context of 3208	3584	spoolsv.exe	131
PID 1516 set thread context of 5056	1516	spoolsv.exe	132
PID 4000 set thread context of 4944	4000	spoolsv.exe	133
PID 3512 set thread context of 2456	3512	spoolsv.exe	134
PID 4120 set thread context of 2476	4120	spoolsv.exe	135
PID 3492 set thread context of 4860	3492	spoolsv.exe	136
PID 3504 set thread context of 4412	3504	spoolsv.exe	138
PID 1464 set thread context of 4364	1464	spoolsv.exe	140
PID 1968 set thread context of 2108	1968	spoolsv.exe	141
PID 5112 set thread context of 772	5112	spoolsv.exe	142
PID 1664 set thread context of 4212	1664	spoolsv.exe	143
PID 3848 set thread context of 3152	3848	spoolsv.exe	145
PID 2328 set thread context of 4508	2328	spoolsv.exe	146
PID 1856 set thread context of 4688	1856	spoolsv.exe	148
PID 2472 set thread context of 1492	2472	spoolsv.exe	149
PID 3772 set thread context of 4308	3772	spoolsv.exe	150
PID 4080 set thread context of 4052	4080	spoolsv.exe	151
PID 3036 set thread context of 4896	3036	spoolsv.exe	152
PID 1748 set thread context of 1152	1748	spoolsv.exe	153
PID 1836 set thread context of 1168	1836	spoolsv.exe	155
PID 3904 set thread context of 4760	3904	spoolsv.exe	157
PID 3588 set thread context of 4328	3588	spoolsv.exe	158
PID 2796 set thread context of 3056	2796	spoolsv.exe	159
PID 2440 set thread context of 4076	2440	spoolsv.exe	160
PID 4964 set thread context of 3836	4964	spoolsv.exe	161
PID 1644 set thread context of 3864	1644	spoolsv.exe	162
PID 2080 set thread context of 364	2080	spoolsv.exe	163
PID 688 set thread context of 1880	688	spoolsv.exe	164
PID 668 set thread context of 4304	668	spoolsv.exe	167
PID 2496 set thread context of 536	2496	spoolsv.exe	168
PID 2928 set thread context of 4556	2928	spoolsv.exe	169
PID 3684 set thread context of 3980	3684	spoolsv.exe	170
PID 908 set thread context of 1956	908	spoolsv.exe	171
PID 4376 set thread context of 2708	4376	spoolsv.exe	173
PID 5048 set thread context of 3972	5048	explorer.exe	179
PID 4084 set thread context of 2232	4084	spoolsv.exe	180
PID 4352 set thread context of 1928	4352	spoolsv.exe	184
PID 3556 set thread context of 3296	3556	explorer.exe	187
PID 3424 set thread context of 1896	3424	spoolsv.exe	191
PID 3912 set thread context of 2800	3912	explorer.exe	193
PID 4540 set thread context of 4404	4540	explorer.exe	202
PID 1004 set thread context of 2792	1004	spoolsv.exe	203
PID 3004 set thread context of 3768	3004	explorer.exe	209
PID 2352 set thread context of 1720	2352	spoolsv.exe	210
PID 3508 set thread context of 1048	3508	spoolsv.exe	212
PID 4208 set thread context of 4372	4208	explorer.exe	213
PID 4256 set thread context of 3432	4256	spoolsv.exe	214
PID 4792 set thread context of 1364	4792	spoolsv.exe	216
PID 4468 set thread context of 1324	4468	spoolsv.exe	219
PID 2184 set thread context of 4772	2184	spoolsv.exe	222
PID 228 set thread context of 2396	228	explorer.exe	224
PID 2000 set thread context of 3044	2000	spoolsv.exe	225
PID 3288 set thread context of 1784	3288	spoolsv.exe	228
PID 4020 set thread context of 1276	4020	explorer.exe	230
PID 4652 set thread context of 1712	4652	spoolsv.exe	231
PID 424 set thread context of 2916	424	spoolsv.exe	233
PID 1952 set thread context of 2040	1952	spoolsv.exe	234

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4464	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4464	explorer.exe
4312	spoolsv.exe
4312	spoolsv.exe
3208	spoolsv.exe
3208	spoolsv.exe
5056	spoolsv.exe
5056	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe
2456	spoolsv.exe
2456	spoolsv.exe
2476	spoolsv.exe
2476	spoolsv.exe
4860	spoolsv.exe
4860	spoolsv.exe
4412	spoolsv.exe
4412	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe
2108	spoolsv.exe
2108	spoolsv.exe
772	spoolsv.exe
772	spoolsv.exe
4212	spoolsv.exe
4212	spoolsv.exe
3152	spoolsv.exe
3152	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
1492	spoolsv.exe
1492	spoolsv.exe
4308	spoolsv.exe
4308	spoolsv.exe
4052	spoolsv.exe
4052	spoolsv.exe
4896	spoolsv.exe
4896	spoolsv.exe
1152	spoolsv.exe
1152	spoolsv.exe
1168	spoolsv.exe
1168	spoolsv.exe
4760	spoolsv.exe
4760	spoolsv.exe
4328	spoolsv.exe
4328	spoolsv.exe
3056	spoolsv.exe
3056	spoolsv.exe
4076	spoolsv.exe
4076	spoolsv.exe
3836	spoolsv.exe
3836	spoolsv.exe
3864	spoolsv.exe
3864	spoolsv.exe
364	spoolsv.exe
364	spoolsv.exe
1880	spoolsv.exe
1880	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4692	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	82
PID 968 wrote to memory of 4692	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	82
PID 968 wrote to memory of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 968 wrote to memory of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 968 wrote to memory of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 968 wrote to memory of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 968 wrote to memory of 4820	968	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	87
PID 4820 wrote to memory of 1316	4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	88
PID 4820 wrote to memory of 1316	4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	88
PID 4820 wrote to memory of 1316	4820	a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe	88
PID 1316 wrote to memory of 4464	1316	explorer.exe	92
PID 1316 wrote to memory of 4464	1316	explorer.exe	92
PID 1316 wrote to memory of 4464	1316	explorer.exe	92
PID 1316 wrote to memory of 4464	1316	explorer.exe	92
PID 1316 wrote to memory of 4464	1316	explorer.exe	92
PID 4464 wrote to memory of 2992	4464	explorer.exe	93
PID 4464 wrote to memory of 2992	4464	explorer.exe	93
PID 4464 wrote to memory of 2992	4464	explorer.exe	93
PID 4464 wrote to memory of 3584	4464	explorer.exe	94
PID 4464 wrote to memory of 3584	4464	explorer.exe	94
PID 4464 wrote to memory of 3584	4464	explorer.exe	94
PID 4464 wrote to memory of 1516	4464	explorer.exe	95
PID 4464 wrote to memory of 1516	4464	explorer.exe	95
PID 4464 wrote to memory of 1516	4464	explorer.exe	95
PID 4464 wrote to memory of 4000	4464	explorer.exe	96
PID 4464 wrote to memory of 4000	4464	explorer.exe	96
PID 4464 wrote to memory of 4000	4464	explorer.exe	96
PID 4464 wrote to memory of 3512	4464	explorer.exe	97
PID 4464 wrote to memory of 3512	4464	explorer.exe	97
PID 4464 wrote to memory of 3512	4464	explorer.exe	97
PID 4464 wrote to memory of 4120	4464	explorer.exe	98
PID 4464 wrote to memory of 4120	4464	explorer.exe	98
PID 4464 wrote to memory of 4120	4464	explorer.exe	98
PID 4464 wrote to memory of 3492	4464	explorer.exe	99
PID 4464 wrote to memory of 3492	4464	explorer.exe	99
PID 4464 wrote to memory of 3492	4464	explorer.exe	99
PID 4464 wrote to memory of 3504	4464	explorer.exe	100
PID 4464 wrote to memory of 3504	4464	explorer.exe	100
PID 4464 wrote to memory of 3504	4464	explorer.exe	100
PID 4464 wrote to memory of 1464	4464	explorer.exe	101
PID 4464 wrote to memory of 1464	4464	explorer.exe	101
PID 4464 wrote to memory of 1464	4464	explorer.exe	101
PID 4464 wrote to memory of 1968	4464	explorer.exe	102
PID 4464 wrote to memory of 1968	4464	explorer.exe	102
PID 4464 wrote to memory of 1968	4464	explorer.exe	102
PID 4464 wrote to memory of 5112	4464	explorer.exe	103
PID 4464 wrote to memory of 5112	4464	explorer.exe	103
PID 4464 wrote to memory of 5112	4464	explorer.exe	103
PID 4464 wrote to memory of 1664	4464	explorer.exe	104
PID 4464 wrote to memory of 1664	4464	explorer.exe	104
PID 4464 wrote to memory of 1664	4464	explorer.exe	104
PID 4464 wrote to memory of 3848	4464	explorer.exe	105
PID 4464 wrote to memory of 3848	4464	explorer.exe	105
PID 4464 wrote to memory of 3848	4464	explorer.exe	105
PID 4464 wrote to memory of 2328	4464	explorer.exe	106
PID 4464 wrote to memory of 2328	4464	explorer.exe	106
PID 4464 wrote to memory of 2328	4464	explorer.exe	106
PID 4464 wrote to memory of 1856	4464	explorer.exe	107
PID 4464 wrote to memory of 1856	4464	explorer.exe	107
PID 4464 wrote to memory of 1856	4464	explorer.exe	107
PID 4464 wrote to memory of 2472	4464	explorer.exe	108
PID 4464 wrote to memory of 2472	4464	explorer.exe	108
PID 4464 wrote to memory of 2472	4464	explorer.exe	108
PID 4464 wrote to memory of 3772	4464	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a16222ed5b1a35ae606e22ccd0b92b9f_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5048
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3556
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3912
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4208
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1896
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1324
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1784
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 fa8533cdfda9b75352c50d5ef0443ec6fc28adbffc51a14372709bf24be320d8
MD5 4e8595cf1be4748310725be3825f68fe
SHA1 3d48587d28d75c85a899aa6f480f50e8ceb9d03e
SHA512 2ffff12c1d4a915abec0f2ad72bd85ef63d5980fceb9b6e62db777395dc29316a5ddab8f54308f85719d33e3003b6851811c4a09546ada47abe79d75b150afb3
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWwwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 3a58a3350c9b278fb3bccdc82868d0aa1a0249c0dce7212e9f0d1bad8129e193
MD5 55ba4fe5f5ce01403fef31e051c35f73
SHA1 67469c2c16d77b158588088c21ea8bc95b905b56
SHA512 5342abfa5dc7a09183123e4f97240b6a0a686e30b505ad875436adec1cc5bbfb7304e47a6ebbc89ef2c44bee86183ff66455a12dc5765c76c278d7fa5112a3a2
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-3143-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-2674-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/968-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/968-43-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/968-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/968-0-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/1048-5138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-2932-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1168-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1168-3194-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1276-5763-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1316-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1316-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1324-5445-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1324-5523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1364-5419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1364-5302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1464-1622-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1492-2892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1516-1216-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1516-2424-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1664-1872-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1712-5771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1720-5121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1748-2326-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1784-5754-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1836-2327-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1856-1875-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1880-3205-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1880-3354-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1896-4241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1896-4357-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1928-3911-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1928-4060-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1956-3307-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1956-3312-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1968-1623-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2040-5852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2108-2663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2232-3746-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2232-3844-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2328-1874-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-5563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2440-2427-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2456-2451-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2472-2080-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2476-2460-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2708-3378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2792-4965-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-2415-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2800-4250-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2992-1009-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2992-2403-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3036-2325-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3044-5573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3056-3105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-2769-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3208-2417-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3296-4007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-1410-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3504-1411-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3512-1218-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3584-2419-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3584-1215-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3588-2407-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3768-5127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-2081-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3836-3125-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3848-1873-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3904-2406-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3972-3738-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-3301-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-3296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4000-1217-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4080-2082-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4120-1409-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4212-2682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4304-3274-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-2546-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-3093-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-3097-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-2654-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-2650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-5149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-4821-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-2634-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-1008-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-3037-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4688-2883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4772-5553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-87-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4820-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4860-2469-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4860-2473-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-2923-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-2442-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-2439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-2428-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-1624-0x0000000000400000-0x00000000005D3000-memory.dmp

Download