pony | d37f6d695fe76c1d30853ea6314e3ee52368180eb693ace838c44b71830802c0

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
Size 2.2MB
Sample240612-w2evqsveje
SHA256 d37f6d695fe76c1d30853ea6314e3ee52368180eb693ace838c44b71830802c0
MD5 a1bacbab373eed63249ec581696704d3
SHA1 62e89b9f741697dc6f3ca9d34d3183cd34de5edc
SHA512 56dab91a7c347c09cc9bdbfaa84f487089fce3d062b1c96c0146db42e2bb623d921f0573855180588e390e2a646b5d48e9523a3ae9eaa2be354e58dd3d6e9797
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZx:0UzeyQMS4DqodCnoe+iitjWww1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2040	explorer.exe
3152	explorer.exe
316	spoolsv.exe
2220	spoolsv.exe
2840	spoolsv.exe
4120	spoolsv.exe
2412	spoolsv.exe
3692	spoolsv.exe
1816	spoolsv.exe
4524	spoolsv.exe
1104	spoolsv.exe
4536	spoolsv.exe
740	spoolsv.exe
4704	spoolsv.exe
3736	spoolsv.exe
2428	spoolsv.exe
4748	spoolsv.exe
2244	spoolsv.exe
5004	spoolsv.exe
924	spoolsv.exe
388	spoolsv.exe
4404	spoolsv.exe
4416	spoolsv.exe
640	spoolsv.exe
4212	spoolsv.exe
4720	spoolsv.exe
60	spoolsv.exe
2460	spoolsv.exe
2804	spoolsv.exe
720	spoolsv.exe
3060	spoolsv.exe
3256	spoolsv.exe
2228	spoolsv.exe
2572	spoolsv.exe
1500	spoolsv.exe
1260	spoolsv.exe
2388	spoolsv.exe
4380	spoolsv.exe
3164	spoolsv.exe
3088	explorer.exe
3956	spoolsv.exe
4488	spoolsv.exe
3892	spoolsv.exe
2844	spoolsv.exe
3680	spoolsv.exe
4492	spoolsv.exe
1732	spoolsv.exe
1476	spoolsv.exe
4640	spoolsv.exe
3528	explorer.exe
2396	spoolsv.exe
4428	spoolsv.exe
4700	spoolsv.exe
5096	spoolsv.exe
4292	spoolsv.exe
3464	spoolsv.exe
3048	spoolsv.exe
116	spoolsv.exe
948	spoolsv.exe
1020	spoolsv.exe
1468	explorer.exe
436	spoolsv.exe
4724	spoolsv.exe
2272	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 50 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 2040 set thread context of 3152	2040	explorer.exe	91
PID 316 set thread context of 3164	316	spoolsv.exe	128
PID 2220 set thread context of 3956	2220	spoolsv.exe	130
PID 2840 set thread context of 4488	2840	spoolsv.exe	131
PID 4120 set thread context of 3892	4120	spoolsv.exe	132
PID 2412 set thread context of 2844	2412	spoolsv.exe	133
PID 3692 set thread context of 3680	3692	spoolsv.exe	134
PID 1816 set thread context of 4492	1816	spoolsv.exe	135
PID 4524 set thread context of 1476	4524	spoolsv.exe	137
PID 1104 set thread context of 4640	1104	spoolsv.exe	138
PID 4536 set thread context of 2396	4536	spoolsv.exe	140
PID 740 set thread context of 4428	740	spoolsv.exe	141
PID 4704 set thread context of 4700	4704	spoolsv.exe	142
PID 3736 set thread context of 5096	3736	spoolsv.exe	143
PID 2428 set thread context of 4292	2428	spoolsv.exe	144
PID 4748 set thread context of 3464	4748	spoolsv.exe	145
PID 2244 set thread context of 116	2244	spoolsv.exe	147
PID 5004 set thread context of 948	5004	spoolsv.exe	148
PID 924 set thread context of 1020	924	spoolsv.exe	149
PID 388 set thread context of 436	388	spoolsv.exe	151
PID 4404 set thread context of 4724	4404	spoolsv.exe	152
PID 4416 set thread context of 2272	4416	spoolsv.exe	153
PID 640 set thread context of 3792	640	spoolsv.exe	154
PID 4212 set thread context of 4824	4212	spoolsv.exe	155
PID 4720 set thread context of 4436	4720	spoolsv.exe	156
PID 60 set thread context of 4936	60	spoolsv.exe	157
PID 2460 set thread context of 592	2460	spoolsv.exe	158
PID 2804 set thread context of 468	2804	spoolsv.exe	160
PID 720 set thread context of 772	720	spoolsv.exe	161
PID 3060 set thread context of 2396	3060	spoolsv.exe	163
PID 3256 set thread context of 976	3256	spoolsv.exe	164
PID 2228 set thread context of 3172	2228	spoolsv.exe	165
PID 2572 set thread context of 1860	2572	spoolsv.exe	166
PID 1500 set thread context of 4612	1500	spoolsv.exe	167
PID 1260 set thread context of 4476	1260	spoolsv.exe	169
PID 2388 set thread context of 3000	2388	spoolsv.exe	170
PID 4380 set thread context of 4008	4380	spoolsv.exe	176
PID 3088 set thread context of 3536	3088	explorer.exe	178
PID 1732 set thread context of 1336	1732	spoolsv.exe	186
PID 3528 set thread context of 3644	3528	explorer.exe	189
PID 3048 set thread context of 4368	3048	spoolsv.exe	197
PID 1468 set thread context of 4632	1468	explorer.exe	200
PID 440 set thread context of 3488	440	spoolsv.exe	206
PID 4468 set thread context of 4820	4468	explorer.exe	208
PID 2492 set thread context of 5028	2492	spoolsv.exe	209
PID 4584 set thread context of 2424	4584	explorer.exe	210
PID 3184 set thread context of 3688	3184	spoolsv.exe	211
PID 3496 set thread context of 4176	3496	spoolsv.exe	213
PID 3052 set thread context of 3968	3052	spoolsv.exe	216

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3152	explorer.exe
3164	spoolsv.exe
3164	spoolsv.exe
3956	spoolsv.exe
3956	spoolsv.exe
4488	spoolsv.exe
4488	spoolsv.exe
3892	spoolsv.exe
3892	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
3680	spoolsv.exe
3680	spoolsv.exe
4492	spoolsv.exe
4492	spoolsv.exe
1476	spoolsv.exe
1476	spoolsv.exe
4640	spoolsv.exe
4640	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
4428	spoolsv.exe
4428	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
4292	spoolsv.exe
4292	spoolsv.exe
3464	spoolsv.exe
3464	spoolsv.exe
116	spoolsv.exe
116	spoolsv.exe
948	spoolsv.exe
948	spoolsv.exe
1020	spoolsv.exe
1020	spoolsv.exe
436	spoolsv.exe
436	spoolsv.exe
4724	spoolsv.exe
4724	spoolsv.exe
2272	spoolsv.exe
2272	spoolsv.exe
3792	spoolsv.exe
3792	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
4436	spoolsv.exe
4436	spoolsv.exe
4936	spoolsv.exe
4936	spoolsv.exe
592	spoolsv.exe
592	spoolsv.exe
468	spoolsv.exe
468	spoolsv.exe
772	spoolsv.exe
772	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3780	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	81
PID 1612 wrote to memory of 3780	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	81
PID 1612 wrote to memory of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 1612 wrote to memory of 3532	1612	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	86
PID 3532 wrote to memory of 2040	3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	87
PID 3532 wrote to memory of 2040	3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	87
PID 3532 wrote to memory of 2040	3532	a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe	87
PID 2040 wrote to memory of 3152	2040	explorer.exe	91
PID 2040 wrote to memory of 3152	2040	explorer.exe	91
PID 2040 wrote to memory of 3152	2040	explorer.exe	91
PID 2040 wrote to memory of 3152	2040	explorer.exe	91
PID 2040 wrote to memory of 3152	2040	explorer.exe	91
PID 3152 wrote to memory of 316	3152	explorer.exe	92
PID 3152 wrote to memory of 316	3152	explorer.exe	92
PID 3152 wrote to memory of 316	3152	explorer.exe	92
PID 3152 wrote to memory of 2220	3152	explorer.exe	93
PID 3152 wrote to memory of 2220	3152	explorer.exe	93
PID 3152 wrote to memory of 2220	3152	explorer.exe	93
PID 3152 wrote to memory of 2840	3152	explorer.exe	94
PID 3152 wrote to memory of 2840	3152	explorer.exe	94
PID 3152 wrote to memory of 2840	3152	explorer.exe	94
PID 3152 wrote to memory of 4120	3152	explorer.exe	95
PID 3152 wrote to memory of 4120	3152	explorer.exe	95
PID 3152 wrote to memory of 4120	3152	explorer.exe	95
PID 3152 wrote to memory of 2412	3152	explorer.exe	96
PID 3152 wrote to memory of 2412	3152	explorer.exe	96
PID 3152 wrote to memory of 2412	3152	explorer.exe	96
PID 3152 wrote to memory of 3692	3152	explorer.exe	97
PID 3152 wrote to memory of 3692	3152	explorer.exe	97
PID 3152 wrote to memory of 3692	3152	explorer.exe	97
PID 3152 wrote to memory of 1816	3152	explorer.exe	98
PID 3152 wrote to memory of 1816	3152	explorer.exe	98
PID 3152 wrote to memory of 1816	3152	explorer.exe	98
PID 3152 wrote to memory of 4524	3152	explorer.exe	99
PID 3152 wrote to memory of 4524	3152	explorer.exe	99
PID 3152 wrote to memory of 4524	3152	explorer.exe	99
PID 3152 wrote to memory of 1104	3152	explorer.exe	100
PID 3152 wrote to memory of 1104	3152	explorer.exe	100
PID 3152 wrote to memory of 1104	3152	explorer.exe	100
PID 3152 wrote to memory of 4536	3152	explorer.exe	101
PID 3152 wrote to memory of 4536	3152	explorer.exe	101
PID 3152 wrote to memory of 4536	3152	explorer.exe	101
PID 3152 wrote to memory of 740	3152	explorer.exe	102
PID 3152 wrote to memory of 740	3152	explorer.exe	102
PID 3152 wrote to memory of 740	3152	explorer.exe	102
PID 3152 wrote to memory of 4704	3152	explorer.exe	103
PID 3152 wrote to memory of 4704	3152	explorer.exe	103
PID 3152 wrote to memory of 4704	3152	explorer.exe	103
PID 3152 wrote to memory of 3736	3152	explorer.exe	104
PID 3152 wrote to memory of 3736	3152	explorer.exe	104
PID 3152 wrote to memory of 3736	3152	explorer.exe	104
PID 3152 wrote to memory of 2428	3152	explorer.exe	105
PID 3152 wrote to memory of 2428	3152	explorer.exe	105
PID 3152 wrote to memory of 2428	3152	explorer.exe	105
PID 3152 wrote to memory of 4748	3152	explorer.exe	106
PID 3152 wrote to memory of 4748	3152	explorer.exe	106
PID 3152 wrote to memory of 4748	3152	explorer.exe	106
PID 3152 wrote to memory of 2244	3152	explorer.exe	107
PID 3152 wrote to memory of 2244	3152	explorer.exe	107
PID 3152 wrote to memory of 2244	3152	explorer.exe	107
PID 3152 wrote to memory of 5004	3152	explorer.exe	108

C:\Users\Admin\AppData\Local\Temp\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a1bacbab373eed63249ec581696704d3_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3532
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3088
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3528
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1468
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:60
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3000
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4584
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4368
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1504
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 be08b93a753fe3c0471598464c079b9c9e32ca7d52520301c85609efe4686e2c
MD5 ace77fdc10df406852472a04c8aeeb99
SHA1 ea72f692632d4c050ce93136b407c69837939939
SHA512 85adc6131acdf372d1b8c4fbfd3da6dd5746e86fd1127aeaca14a8645d6cbc81cdd47ac7bc0e36bb68cad961f88b5c48038f606063593bbf7a07a4024e882fb2
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 e40ee5e33809d94d0e15d3b6b8134a3134858157a94b2f7e79b8851a50065efb
MD5 8b242b8abf49f13a0783dc606389b191
SHA1 a096a78618940a0eecd7e36d0c80e0c722abbc1d
SHA512 b1ed09659a6efa93db8761f7c2335235dbc1a23503edaf39d115946b7564ab88deda5c21aa8b00eaceee92c9e00a24385c9293808e285add422ecda59a317026
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-2430-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/316-1053-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/316-2418-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/388-2287-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/396-6018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/436-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/468-3075-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/592-3012-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-2421-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/740-1718-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/772-3345-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-3159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/868-6027-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-2085-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/948-2819-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/948-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/976-3175-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1020-2913-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1020-3131-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1104-1716-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1336-4283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-2566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-2568-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1504-6120-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1612-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1612-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1612-43-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1612-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1816-1494-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2040-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2040-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2220-1264-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2220-2436-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2244-2083-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-2666-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2412-1267-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2424-5439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2428-1893-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2460-2445-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2720-6037-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2840-1265-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2840-2442-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2844-2466-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3000-3491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3000-3373-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3124-5937-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3124-5935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-1052-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-99-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3164-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3164-2423-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3172-3184-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3436-5929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3464-2718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-5406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-5525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3532-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3532-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3532-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3532-45-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3536-3782-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-4441-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3680-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3688-5447-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3692-1493-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3736-1892-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3792-2950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3892-2455-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-2435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-5682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-5825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4008-3708-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4120-1266-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4176-5539-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4176-5646-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-2422-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4292-2706-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4368-4923-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4368-5049-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-2296-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4416-2297-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4428-2678-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4476-3280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4488-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-2486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-1495-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4536-1717-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4612-3200-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-5011-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4640-2895-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4640-2655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-1891-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4708-5919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-6092-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4720-2429-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4724-2929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-2082-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4820-5419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5004-2084-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5096-2696-0x0000000000400000-0x000000000043E000-memory.dmp

Download