pony | 2b51388a5f7dfffe320fd3f2141f7336d995b1a7a9243fd4d8c1b0750e6aa7b8

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
Size 2.2MB
Sample240612-vxhkdssgmc
SHA256 2b51388a5f7dfffe320fd3f2141f7336d995b1a7a9243fd4d8c1b0750e6aa7b8
MD5 a17a99e9a2fe01e679792060e56965aa
SHA1 3f14826610fdc663baa249c27fed176cf9d2c8d9
SHA512 d1855d774cc064d80857d59a32c50ac57e42ebeb285cc7937865701ab8731ee1f69c2bd4aeb0b99ba63ec4a542b0d8f54fdd84e3969c73550fbe57b22dd67132
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1504	explorer.exe
116	explorer.exe
4532	spoolsv.exe
3720	spoolsv.exe
3568	spoolsv.exe
3256	spoolsv.exe
4592	spoolsv.exe
1468	spoolsv.exe
1192	spoolsv.exe
640	spoolsv.exe
3596	spoolsv.exe
1412	spoolsv.exe
3228	spoolsv.exe
3492	spoolsv.exe
3052	spoolsv.exe
1856	spoolsv.exe
1260	spoolsv.exe
4908	spoolsv.exe
1548	spoolsv.exe
2360	spoolsv.exe
2056	spoolsv.exe
1484	spoolsv.exe
4380	spoolsv.exe
5104	spoolsv.exe
496	spoolsv.exe
3356	spoolsv.exe
3628	spoolsv.exe
4064	spoolsv.exe
1568	spoolsv.exe
4072	spoolsv.exe
2152	spoolsv.exe
684	spoolsv.exe
1516	spoolsv.exe
2008	spoolsv.exe
3576	spoolsv.exe
3060	spoolsv.exe
1868	spoolsv.exe
2876	spoolsv.exe
4048	spoolsv.exe
2052	explorer.exe
1660	spoolsv.exe
3252	spoolsv.exe
1036	spoolsv.exe
532	spoolsv.exe
4032	spoolsv.exe
408	spoolsv.exe
4752	spoolsv.exe
4976	spoolsv.exe
4244	explorer.exe
4132	spoolsv.exe
4268	spoolsv.exe
3452	spoolsv.exe
2072	spoolsv.exe
2728	spoolsv.exe
2256	spoolsv.exe
1692	spoolsv.exe
3456	spoolsv.exe
3572	explorer.exe
368	spoolsv.exe
1592	spoolsv.exe
3412	spoolsv.exe
4424	spoolsv.exe
2356	spoolsv.exe
1760	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 1504 set thread context of 116	1504	explorer.exe	93
PID 4532 set thread context of 4048	4532	spoolsv.exe	130
PID 3720 set thread context of 1660	3720	spoolsv.exe	132
PID 3568 set thread context of 3252	3568	spoolsv.exe	133
PID 3256 set thread context of 1036	3256	spoolsv.exe	134
PID 4592 set thread context of 532	4592	spoolsv.exe	135
PID 1468 set thread context of 4032	1468	spoolsv.exe	136
PID 1192 set thread context of 408	1192	spoolsv.exe	137
PID 640 set thread context of 4976	640	spoolsv.exe	139
PID 3596 set thread context of 4132	3596	spoolsv.exe	141
PID 1412 set thread context of 4268	1412	spoolsv.exe	142
PID 3228 set thread context of 3452	3228	spoolsv.exe	143
PID 3492 set thread context of 2072	3492	spoolsv.exe	144
PID 3052 set thread context of 2728	3052	spoolsv.exe	145
PID 1856 set thread context of 2256	1856	spoolsv.exe	146
PID 1260 set thread context of 3456	1260	spoolsv.exe	148
PID 4908 set thread context of 368	4908	spoolsv.exe	150
PID 1548 set thread context of 1592	1548	spoolsv.exe	151
PID 2360 set thread context of 3412	2360	spoolsv.exe	152
PID 2056 set thread context of 4424	2056	spoolsv.exe	153
PID 1484 set thread context of 1760	1484	spoolsv.exe	155
PID 4380 set thread context of 2388	4380	spoolsv.exe	156
PID 5104 set thread context of 1832	5104	spoolsv.exe	157
PID 496 set thread context of 1836	496	spoolsv.exe	159
PID 3356 set thread context of 1776	3356	spoolsv.exe	160
PID 3628 set thread context of 556	3628	spoolsv.exe	161
PID 4064 set thread context of 2320	4064	spoolsv.exe	162
PID 1568 set thread context of 3920	1568	spoolsv.exe	164
PID 4072 set thread context of 4212	4072	spoolsv.exe	165
PID 2152 set thread context of 4636	2152	spoolsv.exe	167
PID 684 set thread context of 4360	684	spoolsv.exe	168
PID 1516 set thread context of 928	1516	spoolsv.exe	169
PID 2008 set thread context of 4288	2008	spoolsv.exe	170
PID 3576 set thread context of 4632	3576	spoolsv.exe	172
PID 3060 set thread context of 1180	3060	spoolsv.exe	173
PID 1868 set thread context of 1376	1868	spoolsv.exe	174
PID 2052 set thread context of 4336	2052	explorer.exe	180
PID 2876 set thread context of 2192	2876	spoolsv.exe	181
PID 4752 set thread context of 2028	4752	spoolsv.exe	187
PID 4244 set thread context of 932	4244	explorer.exe	189
PID 1692 set thread context of 1576	1692	spoolsv.exe	194
PID 3572 set thread context of 2816	3572	explorer.exe	197
PID 2356 set thread context of 2244	2356	spoolsv.exe	202
PID 5064 set thread context of 4344	5064	explorer.exe	204
PID 4308 set thread context of 4448	4308	spoolsv.exe	210
PID 572 set thread context of 4024	572	explorer.exe	213
PID 1200 set thread context of 3268	1200	spoolsv.exe	214
PID 4872 set thread context of 4512	4872	explorer.exe	216
PID 2372 set thread context of 456	2372	spoolsv.exe	217
PID 3316 set thread context of 4816	3316	spoolsv.exe	219
PID 2164 set thread context of 3836	2164	spoolsv.exe	221
PID 4036 set thread context of 3704	4036	spoolsv.exe	224
PID 5116 set thread context of 3160	5116	explorer.exe	226
PID 4508 set thread context of 644	4508	spoolsv.exe	227
PID 1596 set thread context of 2328	1596	spoolsv.exe	229
PID 4136 set thread context of 2616	4136	spoolsv.exe	230

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
116	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
116	explorer.exe
4048	spoolsv.exe
4048	spoolsv.exe
1660	spoolsv.exe
1660	spoolsv.exe
3252	spoolsv.exe
3252	spoolsv.exe
1036	spoolsv.exe
1036	spoolsv.exe
532	spoolsv.exe
532	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
408	spoolsv.exe
408	spoolsv.exe
4976	spoolsv.exe
4976	spoolsv.exe
4132	spoolsv.exe
4132	spoolsv.exe
4268	spoolsv.exe
4268	spoolsv.exe
3452	spoolsv.exe
3452	spoolsv.exe
2072	spoolsv.exe
2072	spoolsv.exe
2728	spoolsv.exe
2728	spoolsv.exe
2256	spoolsv.exe
2256	spoolsv.exe
3456	spoolsv.exe
3456	spoolsv.exe
368	spoolsv.exe
368	spoolsv.exe
1592	spoolsv.exe
1592	spoolsv.exe
3412	spoolsv.exe
3412	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
1760	spoolsv.exe
1760	spoolsv.exe
2388	spoolsv.exe
2388	spoolsv.exe
1832	spoolsv.exe
1832	spoolsv.exe
1836	spoolsv.exe
1836	spoolsv.exe
1776	spoolsv.exe
1776	spoolsv.exe
556	spoolsv.exe
556	spoolsv.exe
2320	spoolsv.exe
2320	spoolsv.exe
3920	spoolsv.exe
3920	spoolsv.exe
4212	spoolsv.exe
4212	spoolsv.exe
4636	spoolsv.exe
4636	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4436	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	80
PID 468 wrote to memory of 4436	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	80
PID 468 wrote to memory of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 468 wrote to memory of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 468 wrote to memory of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 468 wrote to memory of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 468 wrote to memory of 4396	468	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	88
PID 4396 wrote to memory of 1504	4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	89
PID 4396 wrote to memory of 1504	4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	89
PID 4396 wrote to memory of 1504	4396	a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe	89
PID 1504 wrote to memory of 116	1504	explorer.exe	93
PID 1504 wrote to memory of 116	1504	explorer.exe	93
PID 1504 wrote to memory of 116	1504	explorer.exe	93
PID 1504 wrote to memory of 116	1504	explorer.exe	93
PID 1504 wrote to memory of 116	1504	explorer.exe	93
PID 116 wrote to memory of 4532	116	explorer.exe	94
PID 116 wrote to memory of 4532	116	explorer.exe	94
PID 116 wrote to memory of 4532	116	explorer.exe	94
PID 116 wrote to memory of 3720	116	explorer.exe	95
PID 116 wrote to memory of 3720	116	explorer.exe	95
PID 116 wrote to memory of 3720	116	explorer.exe	95
PID 116 wrote to memory of 3568	116	explorer.exe	96
PID 116 wrote to memory of 3568	116	explorer.exe	96
PID 116 wrote to memory of 3568	116	explorer.exe	96
PID 116 wrote to memory of 3256	116	explorer.exe	97
PID 116 wrote to memory of 3256	116	explorer.exe	97
PID 116 wrote to memory of 3256	116	explorer.exe	97
PID 116 wrote to memory of 4592	116	explorer.exe	98
PID 116 wrote to memory of 4592	116	explorer.exe	98
PID 116 wrote to memory of 4592	116	explorer.exe	98
PID 116 wrote to memory of 1468	116	explorer.exe	99
PID 116 wrote to memory of 1468	116	explorer.exe	99
PID 116 wrote to memory of 1468	116	explorer.exe	99
PID 116 wrote to memory of 1192	116	explorer.exe	100
PID 116 wrote to memory of 1192	116	explorer.exe	100
PID 116 wrote to memory of 1192	116	explorer.exe	100
PID 116 wrote to memory of 640	116	explorer.exe	101
PID 116 wrote to memory of 640	116	explorer.exe	101
PID 116 wrote to memory of 640	116	explorer.exe	101
PID 116 wrote to memory of 3596	116	explorer.exe	102
PID 116 wrote to memory of 3596	116	explorer.exe	102
PID 116 wrote to memory of 3596	116	explorer.exe	102
PID 116 wrote to memory of 1412	116	explorer.exe	103
PID 116 wrote to memory of 1412	116	explorer.exe	103
PID 116 wrote to memory of 1412	116	explorer.exe	103
PID 116 wrote to memory of 3228	116	explorer.exe	104
PID 116 wrote to memory of 3228	116	explorer.exe	104
PID 116 wrote to memory of 3228	116	explorer.exe	104
PID 116 wrote to memory of 3492	116	explorer.exe	105
PID 116 wrote to memory of 3492	116	explorer.exe	105
PID 116 wrote to memory of 3492	116	explorer.exe	105
PID 116 wrote to memory of 3052	116	explorer.exe	106
PID 116 wrote to memory of 3052	116	explorer.exe	106
PID 116 wrote to memory of 3052	116	explorer.exe	106
PID 116 wrote to memory of 1856	116	explorer.exe	107
PID 116 wrote to memory of 1856	116	explorer.exe	107
PID 116 wrote to memory of 1856	116	explorer.exe	107
PID 116 wrote to memory of 1260	116	explorer.exe	108
PID 116 wrote to memory of 1260	116	explorer.exe	108
PID 116 wrote to memory of 1260	116	explorer.exe	108
PID 116 wrote to memory of 4908	116	explorer.exe	109
PID 116 wrote to memory of 4908	116	explorer.exe	109
PID 116 wrote to memory of 4908	116	explorer.exe	109
PID 116 wrote to memory of 1548	116	explorer.exe	110

C:\Users\Admin\AppData\Local\Temp\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a17a99e9a2fe01e679792060e56965aa_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4396
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4244
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3572
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:572
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1376
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4872
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2028
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3836
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3704
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4696
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 1c857ea94c37224927d5225c700039adcc15d0c04538a45211eb4acef985d4e6
MD5 2bc56201a0ed4d4593a3801584ddbcf7
SHA1 f0bff07c321477f37a3c6e435a7f2a980105348a
SHA512 aa641541b7d5680768c41ce3fab2fc6f87c9a6c28c79474b6d1c13b71cc745b46f1a2e591bd8910f15d56e4ff124b422f364f8ba7c1d6f37cb44e43d0d6ffd40
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWwwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 4df6ce3414da841ed2246073f297cc7df10cd9f652c14c9c02e7ccec536887d7
MD5 b5c4f96a429de136d4323b8bbcce700d
SHA1 bab0dca4788196e79693ce62ded9812f3fd8e208
SHA512 9b8b7c9fe311b002388d6d909fb0e9ec9bdc4a783d26011851bd5b82c29ce8e8d44b2d1ba86b49a46ba581332ba449311e4ead1ba56859ddf18965b4f390a65e
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZx:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-1043-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/116-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/368-2738-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-2435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/456-5265-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/468-48-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/468-52-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/468-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/468-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/496-2372-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/532-2415-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-2971-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/928-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/932-4057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1192-1445-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1260-1864-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1376-3328-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1376-3446-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1412-1647-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1468-1444-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1484-2286-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1504-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1504-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1548-2070-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1576-4285-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1592-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1660-2383-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1660-2382-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1760-2845-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1776-2963-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1832-2944-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1832-3104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1836-2952-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-1863-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2028-4002-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2056-2285-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2072-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2192-3775-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-4681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-4825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2256-2643-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2328-5721-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2360-2086-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2388-2854-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2616-5732-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2640-6048-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-2631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2816-4370-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3160-5621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3228-1648-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3252-2392-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3256-1227-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3264-5973-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3268-5245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3356-2381-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3412-2756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3452-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3456-2729-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3456-2909-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-1861-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3568-1226-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3568-2394-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3596-1642-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3628-2391-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3704-5611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3704-5784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3720-2379-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3720-1045-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3920-3080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-5234-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-2373-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-2511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4132-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-3138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-2597-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4336-3659-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-4692-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-4689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-3158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-3155-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-2287-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4396-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-51-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4448-5088-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4448-5201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-5254-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4532-2367-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4532-1044-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4592-1228-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4632-3245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-3148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-5885-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-5412-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4908-2069-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4976-2570-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-2706-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5104-2371-0x0000000000400000-0x00000000005D3000-memory.dmp

Download