pony | 929425321d529b52e4ab0100663fcd3f386ea3e82b2c409ba066fd72adfb874a

Analysis

max time kernel
126s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
Size 2.2MB
Sample240613-2982favdlb
SHA256 929425321d529b52e4ab0100663fcd3f386ea3e82b2c409ba066fd72adfb874a
MD5 a7119baa2b726e6524aef6d6a1cbc910
SHA1 89688d7c32681865c5b582ba6eba570a299cc7e1
SHA512 9bbb8f2dc732135b0d115c84f152319f09b472d2126d43cc701516e068fde6ca0d099175a59dd9d4fd56ce54587c3025bd05692ef6e1aad4c01fc67251f33e00
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4108	explorer.exe
2412	explorer.exe
1460	spoolsv.exe
3436	spoolsv.exe
3292	spoolsv.exe
764	spoolsv.exe
2364	spoolsv.exe
2356	spoolsv.exe
4388	spoolsv.exe
2108	spoolsv.exe
1396	spoolsv.exe
2776	spoolsv.exe
4960	spoolsv.exe
4212	spoolsv.exe
3472	spoolsv.exe
1236	spoolsv.exe
2184	spoolsv.exe
4760	spoolsv.exe
2852	spoolsv.exe
776	spoolsv.exe
1796	spoolsv.exe
2768	spoolsv.exe
2372	spoolsv.exe
5104	spoolsv.exe
1440	spoolsv.exe
4776	spoolsv.exe
2244	spoolsv.exe
808	spoolsv.exe
4248	spoolsv.exe
232	spoolsv.exe
3356	spoolsv.exe
628	spoolsv.exe
4576	spoolsv.exe
4484	spoolsv.exe
2980	spoolsv.exe
2072	explorer.exe
644	spoolsv.exe
640	spoolsv.exe
5076	spoolsv.exe
4192	spoolsv.exe
4428	spoolsv.exe
1616	spoolsv.exe
3220	spoolsv.exe
5052	spoolsv.exe
748	explorer.exe
1816	spoolsv.exe
4836	spoolsv.exe
3896	spoolsv.exe
2024	spoolsv.exe
464	spoolsv.exe
700	spoolsv.exe
2248	spoolsv.exe
3708	spoolsv.exe
4876	spoolsv.exe
1292	spoolsv.exe
2112	explorer.exe
2304	spoolsv.exe
2820	spoolsv.exe
2148	spoolsv.exe
1716	spoolsv.exe
2700	spoolsv.exe
4524	spoolsv.exe
2452	explorer.exe
1508	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 38 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4108 set thread context of 2412	4108	explorer.exe	92
PID 1460 set thread context of 2980	1460	spoolsv.exe	125
PID 3436 set thread context of 644	3436	spoolsv.exe	127
PID 3292 set thread context of 5076	3292	spoolsv.exe	129
PID 764 set thread context of 4192	764	spoolsv.exe	130
PID 2364 set thread context of 4428	2364	spoolsv.exe	131
PID 2356 set thread context of 1616	2356	spoolsv.exe	132
PID 4388 set thread context of 3220	4388	spoolsv.exe	133
PID 2108 set thread context of 5052	2108	spoolsv.exe	134
PID 1396 set thread context of 4836	1396	spoolsv.exe	137
PID 2776 set thread context of 3896	2776	spoolsv.exe	138
PID 4960 set thread context of 2024	4960	spoolsv.exe	139
PID 4212 set thread context of 464	4212	spoolsv.exe	140
PID 3472 set thread context of 700	3472	spoolsv.exe	141
PID 1236 set thread context of 2248	1236	spoolsv.exe	142
PID 2184 set thread context of 3708	2184	spoolsv.exe	143
PID 4760 set thread context of 1292	4760	spoolsv.exe	145
PID 2852 set thread context of 2304	2852	spoolsv.exe	147
PID 776 set thread context of 2820	776	spoolsv.exe	148
PID 1796 set thread context of 2148	1796	spoolsv.exe	149
PID 2768 set thread context of 2700	2768	spoolsv.exe	151
PID 2372 set thread context of 4524	2372	spoolsv.exe	152
PID 5104 set thread context of 1508	5104	spoolsv.exe	154
PID 1440 set thread context of 3528	1440	spoolsv.exe	155
PID 4776 set thread context of 4940	4776	spoolsv.exe	157
PID 2244 set thread context of 2664	2244	spoolsv.exe	158
PID 808 set thread context of 2744	808	spoolsv.exe	160
PID 4248 set thread context of 4868	4248	spoolsv.exe	161
PID 232 set thread context of 3260	232	spoolsv.exe	163
PID 3356 set thread context of 4476	3356	spoolsv.exe	165
PID 628 set thread context of 2864	628	spoolsv.exe	166
PID 4576 set thread context of 4200	4576	spoolsv.exe	168
PID 4484 set thread context of 1628	4484	spoolsv.exe	174
PID 2072 set thread context of 3992	2072	explorer.exe	180
PID 640 set thread context of 1372	640	spoolsv.exe	182
PID 748 set thread context of 3368	748	explorer.exe	188
PID 1816 set thread context of 4480	1816	spoolsv.exe	190

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2980	spoolsv.exe
2980	spoolsv.exe
644	spoolsv.exe
644	spoolsv.exe
5076	spoolsv.exe
5076	spoolsv.exe
4192	spoolsv.exe
4192	spoolsv.exe
4428	spoolsv.exe
4428	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
3220	spoolsv.exe
3220	spoolsv.exe
5052	spoolsv.exe
5052	spoolsv.exe
4836	spoolsv.exe
4836	spoolsv.exe
3896	spoolsv.exe
3896	spoolsv.exe
2024	spoolsv.exe
2024	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
700	spoolsv.exe
700	spoolsv.exe
2248	spoolsv.exe
2248	spoolsv.exe
3708	spoolsv.exe
3708	spoolsv.exe
1292	spoolsv.exe
1292	spoolsv.exe
2304	spoolsv.exe
2304	spoolsv.exe
2820	spoolsv.exe
2820	spoolsv.exe
2148	spoolsv.exe
2148	spoolsv.exe
2700	spoolsv.exe
2700	spoolsv.exe
4524	spoolsv.exe
4524	spoolsv.exe
1508	spoolsv.exe
1508	spoolsv.exe
3528	spoolsv.exe
3528	spoolsv.exe
4940	spoolsv.exe
4940	spoolsv.exe
2664	spoolsv.exe
2664	spoolsv.exe
2744	spoolsv.exe
2744	spoolsv.exe
4868	spoolsv.exe
4868	spoolsv.exe
3260	spoolsv.exe
3260	spoolsv.exe
4476	spoolsv.exe
4476	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 812	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	82
PID 4944 wrote to memory of 812	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	82
PID 4944 wrote to memory of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4944 wrote to memory of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4944 wrote to memory of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4944 wrote to memory of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4944 wrote to memory of 4244	4944	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	87
PID 4244 wrote to memory of 4108	4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	88
PID 4244 wrote to memory of 4108	4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	88
PID 4244 wrote to memory of 4108	4244	a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe	88
PID 4108 wrote to memory of 2412	4108	explorer.exe	92
PID 4108 wrote to memory of 2412	4108	explorer.exe	92
PID 4108 wrote to memory of 2412	4108	explorer.exe	92
PID 4108 wrote to memory of 2412	4108	explorer.exe	92
PID 4108 wrote to memory of 2412	4108	explorer.exe	92
PID 2412 wrote to memory of 1460	2412	explorer.exe	93
PID 2412 wrote to memory of 1460	2412	explorer.exe	93
PID 2412 wrote to memory of 1460	2412	explorer.exe	93
PID 2412 wrote to memory of 3436	2412	explorer.exe	94
PID 2412 wrote to memory of 3436	2412	explorer.exe	94
PID 2412 wrote to memory of 3436	2412	explorer.exe	94
PID 2412 wrote to memory of 3292	2412	explorer.exe	95
PID 2412 wrote to memory of 3292	2412	explorer.exe	95
PID 2412 wrote to memory of 3292	2412	explorer.exe	95
PID 2412 wrote to memory of 764	2412	explorer.exe	96
PID 2412 wrote to memory of 764	2412	explorer.exe	96
PID 2412 wrote to memory of 764	2412	explorer.exe	96
PID 2412 wrote to memory of 2364	2412	explorer.exe	97
PID 2412 wrote to memory of 2364	2412	explorer.exe	97
PID 2412 wrote to memory of 2364	2412	explorer.exe	97
PID 2412 wrote to memory of 2356	2412	explorer.exe	98
PID 2412 wrote to memory of 2356	2412	explorer.exe	98
PID 2412 wrote to memory of 2356	2412	explorer.exe	98
PID 2412 wrote to memory of 4388	2412	explorer.exe	99
PID 2412 wrote to memory of 4388	2412	explorer.exe	99
PID 2412 wrote to memory of 4388	2412	explorer.exe	99
PID 2412 wrote to memory of 2108	2412	explorer.exe	100
PID 2412 wrote to memory of 2108	2412	explorer.exe	100
PID 2412 wrote to memory of 2108	2412	explorer.exe	100
PID 2412 wrote to memory of 1396	2412	explorer.exe	101
PID 2412 wrote to memory of 1396	2412	explorer.exe	101
PID 2412 wrote to memory of 1396	2412	explorer.exe	101
PID 2412 wrote to memory of 2776	2412	explorer.exe	102
PID 2412 wrote to memory of 2776	2412	explorer.exe	102
PID 2412 wrote to memory of 2776	2412	explorer.exe	102
PID 2412 wrote to memory of 4960	2412	explorer.exe	103
PID 2412 wrote to memory of 4960	2412	explorer.exe	103
PID 2412 wrote to memory of 4960	2412	explorer.exe	103
PID 2412 wrote to memory of 4212	2412	explorer.exe	104
PID 2412 wrote to memory of 4212	2412	explorer.exe	104
PID 2412 wrote to memory of 4212	2412	explorer.exe	104
PID 2412 wrote to memory of 3472	2412	explorer.exe	105
PID 2412 wrote to memory of 3472	2412	explorer.exe	105
PID 2412 wrote to memory of 3472	2412	explorer.exe	105
PID 2412 wrote to memory of 1236	2412	explorer.exe	106
PID 2412 wrote to memory of 1236	2412	explorer.exe	106
PID 2412 wrote to memory of 1236	2412	explorer.exe	106
PID 2412 wrote to memory of 2184	2412	explorer.exe	107
PID 2412 wrote to memory of 2184	2412	explorer.exe	107
PID 2412 wrote to memory of 2184	2412	explorer.exe	107
PID 2412 wrote to memory of 4760	2412	explorer.exe	108
PID 2412 wrote to memory of 4760	2412	explorer.exe	108
PID 2412 wrote to memory of 4760	2412	explorer.exe	108
PID 2412 wrote to memory of 2852	2412	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a7119baa2b726e6524aef6d6a1cbc910_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4244
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2452
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4200
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1548
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2288
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1884
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 2569d6fa8962d4b6caf9d5d1e47376b2b8c3cb338efdb8c771c46e06260812bd
MD5 6617def6e1b9ce6987ca8a92610ad8aa
SHA1 cd9e672b1112eb3e1ae9951f2b27ce15f2d34ab1
SHA512 1c961b3dd4bfaa0ae686feccd8dea74144bc42984cb52357cb38140e9b96e3f4e1dcbd1583f693aa185179decbdaae502cc820a1f93d41ccf7b0daa9a32ca741
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWww9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 4065dce3e3a23a8366d06754e282d01b3d0e99fbd23d8ef1761a9b59a6c3d71e
MD5 0d7a0564fad3040435062085ba663b63
SHA1 3cf40a58350e81de64d49d19a29500d28dec7c3b
SHA512 c4f7197fdb4e87cdc59575b04b231cdb80717dd2783e318f39804ee6ce3944e86aa35d52c501954b7a65ecc5f8a7560f35c92ffb149096f7c453d0c5f3d5338c
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-2470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-2141-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-2139-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/764-1067-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/776-2049-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1012-5794-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1012-5799-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1236-1842-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1292-2855-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1292-2680-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1372-4316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1372-4183-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-1447-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1440-2235-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1460-925-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1460-2131-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1496-5148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1508-2894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1616-2275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-3854-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-3770-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1796-2050-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1812-5594-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1828-5516-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1832-4950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1884-5201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1884-5082-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1984-5567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2024-2460-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2108-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2148-2737-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2148-2707-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2152-5356-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-5345-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-5474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2184-1843-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2248-2489-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-5555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2356-1244-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2364-1243-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2372-2129-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2412-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2412-889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-5630-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-3192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2700-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-3084-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-2128-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2776-1448-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2788-5808-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2820-2699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-4893-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-4937-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-2048-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2864-3279-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2864-3282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2956-5503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2980-2130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2980-2347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3112-5538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-2289-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3260-3390-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3260-3254-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3292-1066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3292-2245-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3368-4528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3436-2142-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3436-1065-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3472-1668-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3616-5525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3668-5778-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3708-2575-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3896-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-4094-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4108-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4108-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4192-2255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-3413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-3541-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-1667-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4244-63-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4388-1245-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4428-2264-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4476-3270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-4617-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-4720-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-3058-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-2883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-1844-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4776-2246-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4788-5585-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4836-2434-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-5916-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-5761-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-3046-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-3061-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-0-0x0000000002320000-0x0000000002321000-memory.dmp

Download

memory/4944-23-0x0000000002320000-0x0000000002321000-memory.dmp

Download

memory/4944-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4960-1666-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5052-2571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5076-2244-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5076-2237-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/5104-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download