pony | 8ab941507a4d46e510ab490759dba8e186c42a875a1da62378eae4f3ddc60ba3

Analysis

max time kernel
127s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
Size 2.2MB
Sample240613-3a5qeaydnp
SHA256 8ab941507a4d46e510ab490759dba8e186c42a875a1da62378eae4f3ddc60ba3
MD5 a713bc5a7c91ee946aac99c8a65b5d9a
SHA1 7359b0ee2bdac05ac45e6357fb72a21c33117b82
SHA512 3a8dbaef136f960d89c4bd55b3743f7ffd82003b4617500981ddb6b87ad28bd57b2d09ce247912bccc793da3c1280f71242357514c98ce071c749d67c76f200e
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4444	explorer.exe
220	explorer.exe
2972	spoolsv.exe
4456	spoolsv.exe
3668	spoolsv.exe
4896	spoolsv.exe
4628	spoolsv.exe
2128	spoolsv.exe
944	spoolsv.exe
2760	spoolsv.exe
744	spoolsv.exe
3652	spoolsv.exe
3484	spoolsv.exe
4576	spoolsv.exe
4348	spoolsv.exe
3508	spoolsv.exe
3392	spoolsv.exe
4100	spoolsv.exe
2204	spoolsv.exe
4452	spoolsv.exe
2928	spoolsv.exe
1980	spoolsv.exe
4340	spoolsv.exe
4632	spoolsv.exe
2032	spoolsv.exe
208	spoolsv.exe
4812	spoolsv.exe
3056	spoolsv.exe
212	spoolsv.exe
2736	spoolsv.exe
3168	spoolsv.exe
560	spoolsv.exe
4972	spoolsv.exe
5072	explorer.exe
3576	spoolsv.exe
1588	spoolsv.exe
1104	spoolsv.exe
1380	spoolsv.exe
3184	spoolsv.exe
2496	explorer.exe
716	spoolsv.exe
1700	spoolsv.exe
3096	spoolsv.exe
2932	spoolsv.exe
1844	spoolsv.exe
1588	explorer.exe
4572	spoolsv.exe
4616	spoolsv.exe
636	spoolsv.exe
2432	spoolsv.exe
3076	explorer.exe
1652	spoolsv.exe
5108	spoolsv.exe
3472	spoolsv.exe
2464	spoolsv.exe
436	explorer.exe
468	spoolsv.exe
4036	spoolsv.exe
4764	spoolsv.exe
2788	spoolsv.exe
1272	spoolsv.exe
1004	explorer.exe
1444	spoolsv.exe
224	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 40 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 4444 set thread context of 220	4444	explorer.exe	96
PID 2972 set thread context of 4972	2972	spoolsv.exe	127
PID 4456 set thread context of 3576	4456	spoolsv.exe	129
PID 3668 set thread context of 1588	3668	spoolsv.exe	130
PID 4896 set thread context of 1380	4896	spoolsv.exe	132
PID 4628 set thread context of 3184	4628	spoolsv.exe	133
PID 2128 set thread context of 716	2128	spoolsv.exe	135
PID 944 set thread context of 1700	944	spoolsv.exe	136
PID 2760 set thread context of 2932	2760	spoolsv.exe	138
PID 744 set thread context of 1844	744	spoolsv.exe	139
PID 3652 set thread context of 4572	3652	spoolsv.exe	141
PID 3484 set thread context of 636	3484	spoolsv.exe	143
PID 4576 set thread context of 2432	4576	spoolsv.exe	144
PID 4348 set thread context of 1652	4348	spoolsv.exe	146
PID 3508 set thread context of 3472	3508	spoolsv.exe	148
PID 3392 set thread context of 2464	3392	spoolsv.exe	149
PID 4100 set thread context of 468	4100	spoolsv.exe	151
PID 2204 set thread context of 4764	2204	spoolsv.exe	153
PID 4452 set thread context of 2788	4452	spoolsv.exe	154
PID 2928 set thread context of 1272	2928	spoolsv.exe	155
PID 1980 set thread context of 224	1980	spoolsv.exe	158
PID 4340 set thread context of 4012	4340	spoolsv.exe	159
PID 4632 set thread context of 1572	4632	spoolsv.exe	160
PID 2032 set thread context of 4968	2032	spoolsv.exe	162
PID 208 set thread context of 2988	208	spoolsv.exe	164
PID 4812 set thread context of 4904	4812	spoolsv.exe	165
PID 3056 set thread context of 2916	3056	spoolsv.exe	167
PID 212 set thread context of 4520	212	spoolsv.exe	168
PID 2736 set thread context of 3104	2736	spoolsv.exe	170
PID 3168 set thread context of 3264	3168	spoolsv.exe	174
PID 560 set thread context of 4344	560	spoolsv.exe	179
PID 5072 set thread context of 3544	5072	explorer.exe	181
PID 1104 set thread context of 2692	1104	spoolsv.exe	184
PID 2496 set thread context of 812	2496	explorer.exe	186
PID 3096 set thread context of 3012	3096	spoolsv.exe	188
PID 1588 set thread context of 2092	1588	explorer.exe	191
PID 4616 set thread context of 3044	4616	spoolsv.exe	193
PID 3076 set thread context of 556	3076	explorer.exe	195
PID 5108 set thread context of 4468	5108	spoolsv.exe	197

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
220	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
4972	spoolsv.exe
4972	spoolsv.exe
3576	spoolsv.exe
3576	spoolsv.exe
1588	spoolsv.exe
1588	spoolsv.exe
1380	spoolsv.exe
1380	spoolsv.exe
3184	spoolsv.exe
3184	spoolsv.exe
716	spoolsv.exe
716	spoolsv.exe
1700	spoolsv.exe
1700	spoolsv.exe
2932	spoolsv.exe
2932	spoolsv.exe
1844	spoolsv.exe
1844	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
636	spoolsv.exe
636	spoolsv.exe
2432	spoolsv.exe
2432	spoolsv.exe
1652	spoolsv.exe
1652	spoolsv.exe
3472	spoolsv.exe
3472	spoolsv.exe
2464	spoolsv.exe
2464	spoolsv.exe
468	spoolsv.exe
468	spoolsv.exe
4764	spoolsv.exe
4764	spoolsv.exe
2788	spoolsv.exe
2788	spoolsv.exe
1272	spoolsv.exe
1272	spoolsv.exe
224	spoolsv.exe
224	spoolsv.exe
4012	spoolsv.exe
4012	spoolsv.exe
1572	spoolsv.exe
1572	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
2988	spoolsv.exe
2988	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
2916	spoolsv.exe
2916	spoolsv.exe
4520	spoolsv.exe
4520	spoolsv.exe
3104	spoolsv.exe
3104	spoolsv.exe
3264	spoolsv.exe
3264	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3152	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	82
PID 2492 wrote to memory of 3152	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	82
PID 2492 wrote to memory of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 2492 wrote to memory of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 2492 wrote to memory of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 2492 wrote to memory of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 2492 wrote to memory of 4960	2492	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	87
PID 4960 wrote to memory of 4444	4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	88
PID 4960 wrote to memory of 4444	4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	88
PID 4960 wrote to memory of 4444	4960	a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe	88
PID 4444 wrote to memory of 220	4444	explorer.exe	96
PID 4444 wrote to memory of 220	4444	explorer.exe	96
PID 4444 wrote to memory of 220	4444	explorer.exe	96
PID 4444 wrote to memory of 220	4444	explorer.exe	96
PID 4444 wrote to memory of 220	4444	explorer.exe	96
PID 220 wrote to memory of 2972	220	explorer.exe	97
PID 220 wrote to memory of 2972	220	explorer.exe	97
PID 220 wrote to memory of 2972	220	explorer.exe	97
PID 220 wrote to memory of 4456	220	explorer.exe	98
PID 220 wrote to memory of 4456	220	explorer.exe	98
PID 220 wrote to memory of 4456	220	explorer.exe	98
PID 220 wrote to memory of 3668	220	explorer.exe	99
PID 220 wrote to memory of 3668	220	explorer.exe	99
PID 220 wrote to memory of 3668	220	explorer.exe	99
PID 220 wrote to memory of 4896	220	explorer.exe	100
PID 220 wrote to memory of 4896	220	explorer.exe	100
PID 220 wrote to memory of 4896	220	explorer.exe	100
PID 220 wrote to memory of 4628	220	explorer.exe	101
PID 220 wrote to memory of 4628	220	explorer.exe	101
PID 220 wrote to memory of 4628	220	explorer.exe	101
PID 220 wrote to memory of 2128	220	explorer.exe	102
PID 220 wrote to memory of 2128	220	explorer.exe	102
PID 220 wrote to memory of 2128	220	explorer.exe	102
PID 220 wrote to memory of 944	220	explorer.exe	103
PID 220 wrote to memory of 944	220	explorer.exe	103
PID 220 wrote to memory of 944	220	explorer.exe	103
PID 220 wrote to memory of 2760	220	explorer.exe	104
PID 220 wrote to memory of 2760	220	explorer.exe	104
PID 220 wrote to memory of 2760	220	explorer.exe	104
PID 220 wrote to memory of 744	220	explorer.exe	105
PID 220 wrote to memory of 744	220	explorer.exe	105
PID 220 wrote to memory of 744	220	explorer.exe	105
PID 220 wrote to memory of 3652	220	explorer.exe	106
PID 220 wrote to memory of 3652	220	explorer.exe	106
PID 220 wrote to memory of 3652	220	explorer.exe	106
PID 220 wrote to memory of 3484	220	explorer.exe	107
PID 220 wrote to memory of 3484	220	explorer.exe	107
PID 220 wrote to memory of 3484	220	explorer.exe	107
PID 220 wrote to memory of 4576	220	explorer.exe	108
PID 220 wrote to memory of 4576	220	explorer.exe	108
PID 220 wrote to memory of 4576	220	explorer.exe	108
PID 220 wrote to memory of 4348	220	explorer.exe	109
PID 220 wrote to memory of 4348	220	explorer.exe	109
PID 220 wrote to memory of 4348	220	explorer.exe	109
PID 220 wrote to memory of 3508	220	explorer.exe	110
PID 220 wrote to memory of 3508	220	explorer.exe	110
PID 220 wrote to memory of 3508	220	explorer.exe	110
PID 220 wrote to memory of 3392	220	explorer.exe	111
PID 220 wrote to memory of 3392	220	explorer.exe	111
PID 220 wrote to memory of 3392	220	explorer.exe	111
PID 220 wrote to memory of 4100	220	explorer.exe	112
PID 220 wrote to memory of 4100	220	explorer.exe	112
PID 220 wrote to memory of 4100	220	explorer.exe	112
PID 220 wrote to memory of 2204	220	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a713bc5a7c91ee946aac99c8a65b5d9a_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4960
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1588
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3076
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3952
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:724
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4000
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3012
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4216
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 1f52d3dd8ed839a4f1d7eb22137cd4f91962736f3153f0e666fce18c0a2b9f51
MD5 79ea233e5ed85665003d5433cdba0666
SHA1 7197603078d6f98d1150b93fea21d6f68117fbb4
SHA512 e08ffc76f965331c471bc56157e06ff4dc8ad936d4b9bf8192467928691e4c75953a1776d6150aa0440afe0512ac9cb0a305022c612e8553f77e5f80c2eff3a7
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWwwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 3c39cb18d3d22b3afcfd47c056ecd57d3a4d91b03fd28f3bcf215f72b0106439
MD5 98598f379d5b2d46f967127b898e9078
SHA1 0b460fd91f5c61bc075d49f3e446e22d5396b7c7
SHA512 bd922e3ab632cd7a4128c8f144396489190214ff3426fdc741ecbe6231e7d1a17f8583aa5b2891fcda38f6e47086415ed1562d688b8109a741bdc8e2a6758a07
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-869-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/468-2766-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/552-5606-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-4431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-4435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/636-2510-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/716-2263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/744-1403-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/812-4075-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/888-4699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/888-4701-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/944-1271-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1188-5222-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-2912-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1380-2203-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-3016-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-3013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1588-2081-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1588-2084-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1608-5193-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1652-2607-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1700-2273-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1844-2570-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1844-2411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1980-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2092-4269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2128-1270-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2204-1909-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2424-5045-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2424-4967-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2432-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2432-2738-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2464-2756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2464-2885-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2492-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2492-43-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2492-0-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/2492-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2692-4064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2760-1402-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2788-2849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2788-2851-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2928-2058-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2932-2343-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2972-870-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2972-2060-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2988-3171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3012-4212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3012-4342-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3044-4424-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3044-4543-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-2255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-2387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3264-3683-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3264-3583-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-5182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-1774-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3432-5096-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3432-5133-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3472-2695-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-1587-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3508-1759-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3544-3859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-2070-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3600-4894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3652-1586-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3668-1087-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3668-2075-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4012-3003-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4052-5399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-1908-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4216-5063-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-5618-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-5614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-2079-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4344-3976-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-3850-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4348-1747-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4428-5514-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-99-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-5252-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-2057-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4456-1086-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4456-2071-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4468-4675-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-4568-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4520-3352-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-4755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2420-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4576-1588-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4612-5174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-1269-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4632-2196-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4764-2841-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-1088-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4900-5213-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4960-45-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-3156-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-3320-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2059-0x0000000000400000-0x000000000043E000-memory.dmp

Download