pony | d5d7e61d3d80e0b7a325b1d7c2f5abd1b48f5807344919540d61ad757aa3ec84

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
Size 2.2MB
Sample240612-v3regstamf
SHA256 d5d7e61d3d80e0b7a325b1d7c2f5abd1b48f5807344919540d61ad757aa3ec84
MD5 a18462919cbeacfbf62d75555f0ca811
SHA1 30145cb74cc04c218225661135c37c3948c61a13
SHA512 a582e6c7ff959c78dbfbb2a0905eb7c6dac4a502ba57daf44f0ee7c9db4ac37684fa5e68386dd13bb4b4177543c8fbdb9581f2c7dfd17843af5eb8f578b4d469
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4428	explorer.exe
976	explorer.exe
3020	spoolsv.exe
2204	spoolsv.exe
1312	spoolsv.exe
3992	spoolsv.exe
1464	spoolsv.exe
5112	spoolsv.exe
1012	spoolsv.exe
2404	spoolsv.exe
4588	spoolsv.exe
4620	spoolsv.exe
4592	spoolsv.exe
1748	spoolsv.exe
4800	spoolsv.exe
3436	spoolsv.exe
2388	spoolsv.exe
1824	spoolsv.exe
4060	spoolsv.exe
4284	spoolsv.exe
4804	spoolsv.exe
2164	spoolsv.exe
432	spoolsv.exe
2940	spoolsv.exe
1124	spoolsv.exe
1328	spoolsv.exe
4224	spoolsv.exe
384	spoolsv.exe
2480	spoolsv.exe
1160	spoolsv.exe
4008	spoolsv.exe
4952	spoolsv.exe
4956	spoolsv.exe
5108	spoolsv.exe
5200	spoolsv.exe
5304	spoolsv.exe
5348	explorer.exe
5404	spoolsv.exe
5472	spoolsv.exe
5804	spoolsv.exe
5872	spoolsv.exe
5936	spoolsv.exe
6016	spoolsv.exe
6084	spoolsv.exe
1428	spoolsv.exe
2148	explorer.exe
5604	spoolsv.exe
5700	spoolsv.exe
5776	spoolsv.exe
5888	spoolsv.exe
5900	spoolsv.exe
5948	spoolsv.exe
5360	spoolsv.exe
2396	spoolsv.exe
5412	explorer.exe
5592	spoolsv.exe
5712	spoolsv.exe
5908	spoolsv.exe
5968	spoolsv.exe
3392	spoolsv.exe
3480	explorer.exe
5192	spoolsv.exe
5288	spoolsv.exe
1996	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 59 IoCs

description	pid	Process	procid_target
PID 2848 set thread context of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 4428 set thread context of 976	4428	explorer.exe	103
PID 3020 set thread context of 5304	3020	spoolsv.exe	137
PID 2204 set thread context of 5404	2204	spoolsv.exe	139
PID 1312 set thread context of 5472	1312	spoolsv.exe	140
PID 3992 set thread context of 5872	3992	spoolsv.exe	142
PID 1464 set thread context of 5936	1464	spoolsv.exe	143
PID 5112 set thread context of 6016	5112	spoolsv.exe	144
PID 1012 set thread context of 6084	1012	spoolsv.exe	145
PID 2404 set thread context of 1428	2404	spoolsv.exe	146
PID 4588 set thread context of 5700	4588	spoolsv.exe	149
PID 4620 set thread context of 5776	4620	spoolsv.exe	150
PID 4592 set thread context of 5888	4592	spoolsv.exe	151
PID 1748 set thread context of 5900	1748	spoolsv.exe	152
PID 4800 set thread context of 5948	4800	spoolsv.exe	153
PID 3436 set thread context of 2396	3436	spoolsv.exe	155
PID 2388 set thread context of 5592	2388	spoolsv.exe	157
PID 1824 set thread context of 5712	1824	spoolsv.exe	158
PID 4060 set thread context of 5968	4060	spoolsv.exe	160
PID 4284 set thread context of 3392	4284	spoolsv.exe	161
PID 4804 set thread context of 5192	4804	spoolsv.exe	163
PID 2164 set thread context of 5288	2164	spoolsv.exe	164
PID 432 set thread context of 4220	432	spoolsv.exe	166
PID 2940 set thread context of 5724	2940	spoolsv.exe	167
PID 1124 set thread context of 4144	1124	spoolsv.exe	168
PID 1328 set thread context of 3664	1328	spoolsv.exe	169
PID 4224 set thread context of 4844	4224	spoolsv.exe	170
PID 384 set thread context of 6056	384	spoolsv.exe	171
PID 2480 set thread context of 5052	2480	spoolsv.exe	173
PID 1160 set thread context of 1264	1160	spoolsv.exe	175
PID 4008 set thread context of 5648	4008	spoolsv.exe	176
PID 4952 set thread context of 4612	4952	spoolsv.exe	177
PID 4956 set thread context of 5996	4956	spoolsv.exe	179
PID 5108 set thread context of 4708	5108	spoolsv.exe	181
PID 5200 set thread context of 2364	5200	spoolsv.exe	184
PID 5348 set thread context of 4552	5348	explorer.exe	188
PID 5804 set thread context of 5328	5804	spoolsv.exe	190
PID 2148 set thread context of 8	2148	explorer.exe	195
PID 5604 set thread context of 712	5604	spoolsv.exe	196
PID 5360 set thread context of 1692	5360	spoolsv.exe	199
PID 5412 set thread context of 412	5412	explorer.exe	202
PID 5908 set thread context of 3544	5908	spoolsv.exe	206
PID 3480 set thread context of 1960	3480	explorer.exe	212
PID 1996 set thread context of 5816	1996	spoolsv.exe	215
PID 6108 set thread context of 5100	6108	explorer.exe	219
PID 5196 set thread context of 5336	5196	spoolsv.exe	220
PID 3944 set thread context of 5764	3944	spoolsv.exe	222
PID 5164 set thread context of 4116	5164	explorer.exe	223
PID 2752 set thread context of 5544	2752	spoolsv.exe	225
PID 4088 set thread context of 4940	4088	spoolsv.exe	228
PID 4704 set thread context of 5432	4704	explorer.exe	230
PID 5920 set thread context of 5504	5920	spoolsv.exe	231
PID 392 set thread context of 456	392	spoolsv.exe	233
PID 5292 set thread context of 1336	5292	spoolsv.exe	235
PID 1120 set thread context of 5068	1120	explorer.exe	236
PID 2692 set thread context of 5748	2692	spoolsv.exe	238
PID 2428 set thread context of 4064	2428	spoolsv.exe	240
PID 5028 set thread context of 4344	5028	spoolsv.exe	242
PID 5736 set thread context of 5060	5736	explorer.exe	243

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
976	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
976	explorer.exe
5304	spoolsv.exe
5304	spoolsv.exe
5404	spoolsv.exe
5404	spoolsv.exe
5472	spoolsv.exe
5472	spoolsv.exe
5872	spoolsv.exe
5872	spoolsv.exe
5936	spoolsv.exe
5936	spoolsv.exe
6016	spoolsv.exe
6016	spoolsv.exe
6084	spoolsv.exe
6084	spoolsv.exe
1428	spoolsv.exe
1428	spoolsv.exe
5700	spoolsv.exe
5700	spoolsv.exe
5776	spoolsv.exe
5776	spoolsv.exe
5888	spoolsv.exe
5888	spoolsv.exe
5900	spoolsv.exe
5900	spoolsv.exe
5948	spoolsv.exe
5948	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
5592	spoolsv.exe
5592	spoolsv.exe
5712	spoolsv.exe
5712	spoolsv.exe
5968	spoolsv.exe
5968	spoolsv.exe
3392	spoolsv.exe
3392	spoolsv.exe
5192	spoolsv.exe
5192	spoolsv.exe
5288	spoolsv.exe
5288	spoolsv.exe
4220	spoolsv.exe
4220	spoolsv.exe
5724	spoolsv.exe
5724	spoolsv.exe
4144	spoolsv.exe
4144	spoolsv.exe
3664	spoolsv.exe
3664	spoolsv.exe
4844	spoolsv.exe
4844	spoolsv.exe
6056	spoolsv.exe
6056	spoolsv.exe
5052	spoolsv.exe
5052	spoolsv.exe
1264	spoolsv.exe
1264	spoolsv.exe
5648	spoolsv.exe
5648	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4328	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	89
PID 2848 wrote to memory of 4328	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	89
PID 2848 wrote to memory of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 2848 wrote to memory of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 2848 wrote to memory of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 2848 wrote to memory of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 2848 wrote to memory of 4916	2848	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	98
PID 4916 wrote to memory of 4428	4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	99
PID 4916 wrote to memory of 4428	4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	99
PID 4916 wrote to memory of 4428	4916	a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe	99
PID 4428 wrote to memory of 976	4428	explorer.exe	103
PID 4428 wrote to memory of 976	4428	explorer.exe	103
PID 4428 wrote to memory of 976	4428	explorer.exe	103
PID 4428 wrote to memory of 976	4428	explorer.exe	103
PID 4428 wrote to memory of 976	4428	explorer.exe	103
PID 976 wrote to memory of 3020	976	explorer.exe	104
PID 976 wrote to memory of 3020	976	explorer.exe	104
PID 976 wrote to memory of 3020	976	explorer.exe	104
PID 976 wrote to memory of 2204	976	explorer.exe	105
PID 976 wrote to memory of 2204	976	explorer.exe	105
PID 976 wrote to memory of 2204	976	explorer.exe	105
PID 976 wrote to memory of 1312	976	explorer.exe	106
PID 976 wrote to memory of 1312	976	explorer.exe	106
PID 976 wrote to memory of 1312	976	explorer.exe	106
PID 976 wrote to memory of 3992	976	explorer.exe	107
PID 976 wrote to memory of 3992	976	explorer.exe	107
PID 976 wrote to memory of 3992	976	explorer.exe	107
PID 976 wrote to memory of 1464	976	explorer.exe	108
PID 976 wrote to memory of 1464	976	explorer.exe	108
PID 976 wrote to memory of 1464	976	explorer.exe	108
PID 976 wrote to memory of 5112	976	explorer.exe	109
PID 976 wrote to memory of 5112	976	explorer.exe	109
PID 976 wrote to memory of 5112	976	explorer.exe	109
PID 976 wrote to memory of 1012	976	explorer.exe	110
PID 976 wrote to memory of 1012	976	explorer.exe	110
PID 976 wrote to memory of 1012	976	explorer.exe	110
PID 976 wrote to memory of 2404	976	explorer.exe	111
PID 976 wrote to memory of 2404	976	explorer.exe	111
PID 976 wrote to memory of 2404	976	explorer.exe	111
PID 976 wrote to memory of 4588	976	explorer.exe	112
PID 976 wrote to memory of 4588	976	explorer.exe	112
PID 976 wrote to memory of 4588	976	explorer.exe	112
PID 976 wrote to memory of 4620	976	explorer.exe	113
PID 976 wrote to memory of 4620	976	explorer.exe	113
PID 976 wrote to memory of 4620	976	explorer.exe	113
PID 976 wrote to memory of 4592	976	explorer.exe	114
PID 976 wrote to memory of 4592	976	explorer.exe	114
PID 976 wrote to memory of 4592	976	explorer.exe	114
PID 976 wrote to memory of 1748	976	explorer.exe	115
PID 976 wrote to memory of 1748	976	explorer.exe	115
PID 976 wrote to memory of 1748	976	explorer.exe	115
PID 976 wrote to memory of 4800	976	explorer.exe	116
PID 976 wrote to memory of 4800	976	explorer.exe	116
PID 976 wrote to memory of 4800	976	explorer.exe	116
PID 976 wrote to memory of 3436	976	explorer.exe	117
PID 976 wrote to memory of 3436	976	explorer.exe	117
PID 976 wrote to memory of 3436	976	explorer.exe	117
PID 976 wrote to memory of 2388	976	explorer.exe	118
PID 976 wrote to memory of 2388	976	explorer.exe	118
PID 976 wrote to memory of 2388	976	explorer.exe	118
PID 976 wrote to memory of 1824	976	explorer.exe	119
PID 976 wrote to memory of 1824	976	explorer.exe	119
PID 976 wrote to memory of 1824	976	explorer.exe	119
PID 976 wrote to memory of 4060	976	explorer.exe	120

C:\Users\Admin\AppData\Local\Temp\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a18462919cbeacfbf62d75555f0ca811_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5304
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2148
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:8
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5412
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3480
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6056
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5164
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1120
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4940
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 7ba654663a81dbb4e6ca4fc2e73920973904489109fecf474668a896398bd55c
MD5 37511c771dafd849f7ff414d68ef2f3e
SHA1 ad1bd9dc2cdb10a1cce9f66178cdda76b2c2e511
SHA512 a74051a00ac8c199f32825150ec50091f49ff6c2345082fae65048a69b6edc8adca464d533ee3a5e7d8ccf041931bc8bdbac90612609e245982bf278e8b21406
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWwwv
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 b568ee6e35022513d33793b2d44a3e23cdd7f525b6b20c7ba7d2bdeaacf98794
MD5 b08f1b760f9c6a95c30d91486e8d5d11
SHA1 a5fa3df0fbf828b41ebe64e3495b90838d4013f8
SHA512 97d68d9bf5d6f7db3b76ed52ca27724f74a3a0eba6fb0a9010a0238c52c878ff67f5ca73d49db74b9b211f429f00e6de9f0baac1b19ac92abb7dc1e3c3b99fb5
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-4075-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/412-4284-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/432-2330-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/456-5809-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/456-5671-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/712-4082-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/712-4215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/976-984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/976-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1012-1426-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1124-2337-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1312-2349-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1312-1212-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1328-2352-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1336-5681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-2720-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-2557-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1464-1424-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1692-4235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-4316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1748-1832-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1824-2039-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1960-4855-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2164-2251-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2204-2341-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2204-1211-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2364-3681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2388-2038-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-2793-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2396-2961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2404-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2848-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2848-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2848-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2848-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2940-2331-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3020-985-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3020-2333-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3392-2978-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3436-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3544-4500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3664-3102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-1213-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4060-2040-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4116-5258-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4220-3064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4284-2249-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4428-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4428-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4552-3699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-1627-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4592-1831-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4612-3256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-1628-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4800-1833-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4804-2250-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4844-3110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-77-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4916-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-5505-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-5642-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5060-5904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-5694-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5100-5229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-1425-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5192-2987-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5288-2998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5304-2332-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5304-2517-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5328-3761-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5328-3883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5336-5235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5336-5366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5404-2343-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-5517-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5472-2353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5504-5525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5544-5473-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5544-5396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5648-3248-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5700-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5700-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5712-2822-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5724-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5748-5753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5748-5756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5764-5249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5776-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5816-5036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5816-5128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5872-2438-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5888-2630-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5900-2642-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5936-2448-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5968-2896-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5996-3380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5996-3495-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6016-2459-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6056-3302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6084-2468-0x0000000000400000-0x000000000043E000-memory.dmp

Download