pony | 9c445f4139b2806aa7e9eefacd7aea5dfa29a2cf4c849667175f927ae3b05b55

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
Size

2.2MB
MD5

a270a38b43c9f9dfb3efa2901dfbf13b
SHA1

a1196569e0af55082cb645bab82b6fbee7d34946
SHA256

9c445f4139b2806aa7e9eefacd7aea5dfa29a2cf4c849667175f927ae3b05b55
SHA512

d274433d8dd0b6976eebe08061aa685311bf3364fff43b8e35e611bf71fc39368fb00ebafe7db5a7beb8d6030e8233c999aaf72ddedff04be314a8573a76424e
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWww/

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
928	explorer.exe
60	explorer.exe
64	spoolsv.exe
4520	spoolsv.exe
3276	spoolsv.exe
2816	spoolsv.exe
4796	spoolsv.exe
4920	spoolsv.exe
2884	spoolsv.exe
928	spoolsv.exe
1216	spoolsv.exe
960	spoolsv.exe
1264	spoolsv.exe
3964	spoolsv.exe
1028	spoolsv.exe
4332	spoolsv.exe
4292	spoolsv.exe
5040	spoolsv.exe
2444	spoolsv.exe
4052	spoolsv.exe
3760	spoolsv.exe
4284	spoolsv.exe
3224	spoolsv.exe
2332	spoolsv.exe
3428	spoolsv.exe
1436	spoolsv.exe
4896	spoolsv.exe
4824	spoolsv.exe
4556	spoolsv.exe
2936	spoolsv.exe
2820	spoolsv.exe
4728	spoolsv.exe
1520	spoolsv.exe
4924	spoolsv.exe
1664	spoolsv.exe
2776	explorer.exe
4532	spoolsv.exe
3084	spoolsv.exe
5164	spoolsv.exe
5224	spoolsv.exe
5308	spoolsv.exe
5372	spoolsv.exe
5448	spoolsv.exe
5972	spoolsv.exe
2304	spoolsv.exe
3552	explorer.exe
4268	spoolsv.exe
5192	spoolsv.exe
5456	spoolsv.exe
5492	spoolsv.exe
5640	explorer.exe
5728	spoolsv.exe
5792	spoolsv.exe
5876	spoolsv.exe
6096	spoolsv.exe
3084	spoolsv.exe
5616	spoolsv.exe
736	explorer.exe
5580	spoolsv.exe
4288	spoolsv.exe
5920	spoolsv.exe
2148	spoolsv.exe
5648	spoolsv.exe
2056	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 928 set thread context of 60	928	explorer.exe	101
PID 64 set thread context of 1664	64	spoolsv.exe	134
PID 4520 set thread context of 4532	4520	spoolsv.exe	136
PID 3276 set thread context of 3084	3276	spoolsv.exe	137
PID 2816 set thread context of 5224	2816	spoolsv.exe	139
PID 4796 set thread context of 5308	4796	spoolsv.exe	140
PID 4920 set thread context of 5372	4920	spoolsv.exe	141
PID 2884 set thread context of 5448	2884	spoolsv.exe	142
PID 928 set thread context of 5972	928	spoolsv.exe	143
PID 1216 set thread context of 4268	1216	spoolsv.exe	146
PID 960 set thread context of 5192	960	spoolsv.exe	147
PID 1264 set thread context of 5456	1264	spoolsv.exe	149
PID 3964 set thread context of 5728	3964	spoolsv.exe	151
PID 1028 set thread context of 5792	1028	spoolsv.exe	152
PID 4332 set thread context of 5876	4332	spoolsv.exe	153
PID 4292 set thread context of 6096	4292	spoolsv.exe	154
PID 5040 set thread context of 5616	5040	spoolsv.exe	156
PID 2444 set thread context of 5580	2444	spoolsv.exe	158
PID 4052 set thread context of 4288	4052	spoolsv.exe	159
PID 3760 set thread context of 5920	3760	spoolsv.exe	160
PID 4284 set thread context of 5648	4284	spoolsv.exe	162
PID 3224 set thread context of 5428	3224	spoolsv.exe	164
PID 2332 set thread context of 708	2332	spoolsv.exe	165
PID 3428 set thread context of 5556	3428	spoolsv.exe	166
PID 1436 set thread context of 1524	1436	spoolsv.exe	167
PID 4896 set thread context of 5124	4896	spoolsv.exe	169
PID 4824 set thread context of 5048	4824	spoolsv.exe	171
PID 4556 set thread context of 5328	4556	spoolsv.exe	172
PID 2936 set thread context of 5588	2936	spoolsv.exe	173
PID 2820 set thread context of 3104	2820	spoolsv.exe	175
PID 4728 set thread context of 5960	4728	spoolsv.exe	177
PID 1520 set thread context of 5892	1520	spoolsv.exe	178
PID 4924 set thread context of 180	4924	spoolsv.exe	183
PID 2776 set thread context of 4248	2776	explorer.exe	187
PID 5164 set thread context of 3076	5164	spoolsv.exe	188
PID 3552 set thread context of 4024	3552	explorer.exe	192
PID 2304 set thread context of 6136	2304	spoolsv.exe	193
PID 5492 set thread context of 5608	5492	spoolsv.exe	203
PID 5640 set thread context of 6032	5640	explorer.exe	206
PID 3084 set thread context of 5676	3084	spoolsv.exe	208
PID 736 set thread context of 5480	736	explorer.exe	211
PID 2148 set thread context of 788	2148	spoolsv.exe	214
PID 2056 set thread context of 3360	2056	explorer.exe	216

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
60	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
60	explorer.exe
1664	spoolsv.exe
1664	spoolsv.exe
4532	spoolsv.exe
4532	spoolsv.exe
3084	spoolsv.exe
3084	spoolsv.exe
5224	spoolsv.exe
5224	spoolsv.exe
5308	spoolsv.exe
5308	spoolsv.exe
5372	spoolsv.exe
5372	spoolsv.exe
5448	spoolsv.exe
5448	spoolsv.exe
5972	spoolsv.exe
5972	spoolsv.exe
4268	spoolsv.exe
4268	spoolsv.exe
5192	spoolsv.exe
5192	spoolsv.exe
5456	spoolsv.exe
5456	spoolsv.exe
5728	spoolsv.exe
5728	spoolsv.exe
5792	spoolsv.exe
5792	spoolsv.exe
5876	spoolsv.exe
5876	spoolsv.exe
6096	spoolsv.exe
6096	spoolsv.exe
5616	spoolsv.exe
5616	spoolsv.exe
5580	spoolsv.exe
5580	spoolsv.exe
4288	spoolsv.exe
4288	spoolsv.exe
5920	spoolsv.exe
5920	spoolsv.exe
5648	spoolsv.exe
5648	spoolsv.exe
5428	spoolsv.exe
5428	spoolsv.exe
708	spoolsv.exe
708	spoolsv.exe
5556	spoolsv.exe
5556	spoolsv.exe
1524	spoolsv.exe
1524	spoolsv.exe
5124	spoolsv.exe
5124	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe
5328	spoolsv.exe
5328	spoolsv.exe
5588	spoolsv.exe
5588	spoolsv.exe
3104	spoolsv.exe
3104	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3336	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	89
PID 2088 wrote to memory of 3336	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	89
PID 2088 wrote to memory of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 2088 wrote to memory of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 2088 wrote to memory of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 2088 wrote to memory of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 2088 wrote to memory of 2024	2088	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	95
PID 2024 wrote to memory of 928	2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	96
PID 2024 wrote to memory of 928	2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	96
PID 2024 wrote to memory of 928	2024	a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe	96
PID 928 wrote to memory of 60	928	explorer.exe	101
PID 928 wrote to memory of 60	928	explorer.exe	101
PID 928 wrote to memory of 60	928	explorer.exe	101
PID 928 wrote to memory of 60	928	explorer.exe	101
PID 928 wrote to memory of 60	928	explorer.exe	101
PID 60 wrote to memory of 64	60	explorer.exe	102
PID 60 wrote to memory of 64	60	explorer.exe	102
PID 60 wrote to memory of 64	60	explorer.exe	102
PID 60 wrote to memory of 4520	60	explorer.exe	103
PID 60 wrote to memory of 4520	60	explorer.exe	103
PID 60 wrote to memory of 4520	60	explorer.exe	103
PID 60 wrote to memory of 3276	60	explorer.exe	104
PID 60 wrote to memory of 3276	60	explorer.exe	104
PID 60 wrote to memory of 3276	60	explorer.exe	104
PID 60 wrote to memory of 2816	60	explorer.exe	105
PID 60 wrote to memory of 2816	60	explorer.exe	105
PID 60 wrote to memory of 2816	60	explorer.exe	105
PID 60 wrote to memory of 4796	60	explorer.exe	106
PID 60 wrote to memory of 4796	60	explorer.exe	106
PID 60 wrote to memory of 4796	60	explorer.exe	106
PID 60 wrote to memory of 4920	60	explorer.exe	107
PID 60 wrote to memory of 4920	60	explorer.exe	107
PID 60 wrote to memory of 4920	60	explorer.exe	107
PID 60 wrote to memory of 2884	60	explorer.exe	108
PID 60 wrote to memory of 2884	60	explorer.exe	108
PID 60 wrote to memory of 2884	60	explorer.exe	108
PID 60 wrote to memory of 928	60	explorer.exe	109
PID 60 wrote to memory of 928	60	explorer.exe	109
PID 60 wrote to memory of 928	60	explorer.exe	109
PID 60 wrote to memory of 1216	60	explorer.exe	110
PID 60 wrote to memory of 1216	60	explorer.exe	110
PID 60 wrote to memory of 1216	60	explorer.exe	110
PID 60 wrote to memory of 960	60	explorer.exe	111
PID 60 wrote to memory of 960	60	explorer.exe	111
PID 60 wrote to memory of 960	60	explorer.exe	111
PID 60 wrote to memory of 1264	60	explorer.exe	112
PID 60 wrote to memory of 1264	60	explorer.exe	112
PID 60 wrote to memory of 1264	60	explorer.exe	112
PID 60 wrote to memory of 3964	60	explorer.exe	113
PID 60 wrote to memory of 3964	60	explorer.exe	113
PID 60 wrote to memory of 3964	60	explorer.exe	113
PID 60 wrote to memory of 1028	60	explorer.exe	114
PID 60 wrote to memory of 1028	60	explorer.exe	114
PID 60 wrote to memory of 1028	60	explorer.exe	114
PID 60 wrote to memory of 4332	60	explorer.exe	115
PID 60 wrote to memory of 4332	60	explorer.exe	115
PID 60 wrote to memory of 4332	60	explorer.exe	115
PID 60 wrote to memory of 4292	60	explorer.exe	116
PID 60 wrote to memory of 4292	60	explorer.exe	116
PID 60 wrote to memory of 4292	60	explorer.exe	116
PID 60 wrote to memory of 5040	60	explorer.exe	117
PID 60 wrote to memory of 5040	60	explorer.exe	117
PID 60 wrote to memory of 5040	60	explorer.exe	117
PID 60 wrote to memory of 2444	60	explorer.exe	118

C:\Users\Admin\AppData\Local\Temp\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3336
- C:\Users\Admin\AppData\Local\Temp\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a270a38b43c9f9dfb3efa2901dfbf13b_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:928
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2776
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3552
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2056
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5124
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3104
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1344
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:6128
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5312
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:788
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5172
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5808
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1444,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=1064 /prefetch:8
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
c879f5841ce6d098815677ea7a53d26b

SHA1
11573294a89a4361e01ab50aca8b220c9ccce42a

SHA256
248528488c895ea2132470d998f344c454e247decacb66b4fce89118e42748b0

SHA512
2cfbe81bb0fcd75838743e7dd8e194158fddc04d7e16274db94bc825e59fdb22244000d91d3c1c08fea81f1244f950ef91fefc388a56c7e9fb53a1488e5edadc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
afa35c0db4fe419bb6943f4fc9f6ef68

SHA1
85163886f1a80302df4902527fe7b5976f9e909a

SHA256
a40011fc52ac20c766d5713ca3ce40df3964b897543817470af9d344b4c540ab

SHA512
e680a48a19b41767d6f98323868491f0a1c8aa96ac29faf2e948866a30dd4cce1bde2208fc00f05552c7d409eac3995d3a14a4355dac1abde06797fb726011f7

Download Submit
memory/60-936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/60-86-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/64-2130-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/64-937-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/180-3858-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/180-3746-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/708-3023-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/788-4944-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/788-4829-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/928-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/928-87-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/928-1475-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/960-1481-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1028-1827-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1216-1480-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1264-1614-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1436-2249-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1524-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1664-2137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1664-2359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1772-5411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-75-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-33-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2088-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2088-28-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2088-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2312-5605-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2332-2149-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2444-2009-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2608-5392-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2816-1140-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2864-5753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2884-1293-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2892-5668-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2892-5664-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3076-4097-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3076-4017-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3084-2159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-3523-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-3385-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3224-2136-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3276-2157-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3276-1139-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3428-2154-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3760-2134-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3964-1615-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4024-4118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4052-2010-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4220-5852-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4248-3951-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4268-2465-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-2135-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4288-2846-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-1844-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4332-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4380-5049-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4520-2147-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4520-1138-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4532-2143-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4532-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4796-1291-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4856-5425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4920-1292-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5040-1845-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5048-3196-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5124-3341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5124-3188-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5172-5176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5192-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5224-2255-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5308-2266-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5328-3204-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5372-2277-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5416-5206-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5416-5211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5428-3013-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5448-2285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5456-2594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5464-5676-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5480-4673-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5496-5744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5556-3033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5580-2833-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5580-2837-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5588-3271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5608-4396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5608-4528-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5616-2826-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5616-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5648-3004-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5648-3121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5676-4744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5676-4599-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5792-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5808-5376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5808-5198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5876-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5892-3455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5920-2855-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5972-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6032-4470-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6032-4466-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-2715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-2641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download