pony | 086ba02b56b90523de75550b5a8dbe4b76eb06f977888f1cc224c25c38ac1a99

Analysis

max time kernel
142s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
Size 2.2MB
Sample240613-avfb2axbra
SHA256 086ba02b56b90523de75550b5a8dbe4b76eb06f977888f1cc224c25c38ac1a99
MD5 a32873beb7c2c72a08ba6332603e9f05
SHA1 1bfed510e7b763f9beb590638cebd5048927a5c4
SHA512 67fdf7916551c1f3fbdf5ca6132919f061c18f25d0e181df2a35916e37aa86ca8feff1a081a02d73c7e8f617b5c82778d899c683e9d61fc74887eeda49c199ef
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWwwn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4524	explorer.exe
3160	explorer.exe
412	spoolsv.exe
816	spoolsv.exe
1716	spoolsv.exe
1152	spoolsv.exe
4588	spoolsv.exe
1436	spoolsv.exe
4996	spoolsv.exe
4120	spoolsv.exe
2256	spoolsv.exe
4268	spoolsv.exe
2400	spoolsv.exe
4692	spoolsv.exe
2296	spoolsv.exe
4524	spoolsv.exe
2352	spoolsv.exe
1620	spoolsv.exe
1500	spoolsv.exe
2080	spoolsv.exe
1820	spoolsv.exe
3388	spoolsv.exe
1668	spoolsv.exe
536	spoolsv.exe
3952	spoolsv.exe
2068	spoolsv.exe
1308	spoolsv.exe
4528	spoolsv.exe
1044	spoolsv.exe
1116	spoolsv.exe
4828	spoolsv.exe
5032	spoolsv.exe
2484	spoolsv.exe
5080	explorer.exe
3100	spoolsv.exe
1648	spoolsv.exe
2232	spoolsv.exe
3872	spoolsv.exe
4724	spoolsv.exe
1176	spoolsv.exe
4592	explorer.exe
2480	spoolsv.exe
1360	spoolsv.exe
2372	spoolsv.exe
4512	spoolsv.exe
2260	spoolsv.exe
3516	spoolsv.exe
4320	spoolsv.exe
4904	explorer.exe
2164	spoolsv.exe
2304	spoolsv.exe
3496	spoolsv.exe
3868	spoolsv.exe
2092	spoolsv.exe
736	spoolsv.exe
1036	spoolsv.exe
4648	explorer.exe
1204	spoolsv.exe
1208	spoolsv.exe
5116	spoolsv.exe
4584	spoolsv.exe
3892	spoolsv.exe
5024	explorer.exe
5052	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 48 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 4524 set thread context of 3160	4524	explorer.exe	95
PID 412 set thread context of 2484	412	spoolsv.exe	126
PID 816 set thread context of 1648	816	spoolsv.exe	129
PID 1716 set thread context of 2232	1716	spoolsv.exe	130
PID 1152 set thread context of 3872	1152	spoolsv.exe	131
PID 4588 set thread context of 4724	4588	spoolsv.exe	132
PID 1436 set thread context of 1176	1436	spoolsv.exe	133
PID 4996 set thread context of 2480	4996	spoolsv.exe	135
PID 4120 set thread context of 2372	4120	spoolsv.exe	137
PID 2256 set thread context of 4512	2256	spoolsv.exe	138
PID 4268 set thread context of 2260	4268	spoolsv.exe	139
PID 2400 set thread context of 3516	2400	spoolsv.exe	140
PID 4692 set thread context of 4320	4692	spoolsv.exe	141
PID 2296 set thread context of 2164	2296	spoolsv.exe	143
PID 4524 set thread context of 3496	4524	spoolsv.exe	145
PID 2352 set thread context of 3868	2352	spoolsv.exe	146
PID 1620 set thread context of 2092	1620	spoolsv.exe	147
PID 1500 set thread context of 736	1500	spoolsv.exe	148
PID 2080 set thread context of 1036	2080	spoolsv.exe	149
PID 1820 set thread context of 1208	1820	spoolsv.exe	152
PID 3388 set thread context of 5116	3388	spoolsv.exe	153
PID 1668 set thread context of 4584	1668	spoolsv.exe	154
PID 536 set thread context of 3892	536	spoolsv.exe	155
PID 3952 set thread context of 3680	3952	spoolsv.exe	158
PID 2068 set thread context of 4272	2068	spoolsv.exe	159
PID 1308 set thread context of 4912	1308	spoolsv.exe	160
PID 4528 set thread context of 4604	4528	spoolsv.exe	162
PID 1044 set thread context of 2396	1044	spoolsv.exe	164
PID 1116 set thread context of 3984	1116	spoolsv.exe	165
PID 4828 set thread context of 4424	4828	spoolsv.exe	166
PID 5032 set thread context of 2740	5032	spoolsv.exe	168
PID 5080 set thread context of 4816	5080	explorer.exe	173
PID 3100 set thread context of 1652	3100	spoolsv.exe	175
PID 4592 set thread context of 3692	4592	explorer.exe	182
PID 1360 set thread context of 3624	1360	spoolsv.exe	184
PID 4904 set thread context of 1512	4904	explorer.exe	189
PID 2304 set thread context of 3140	2304	spoolsv.exe	190
PID 4648 set thread context of 632	4648	explorer.exe	195
PID 1204 set thread context of 1960	1204	spoolsv.exe	196
PID 5024 set thread context of 4340	5024	explorer.exe	201
PID 5052 set thread context of 1844	5052	spoolsv.exe	202
PID 5108 set thread context of 1112	5108	explorer.exe	205
PID 4776 set thread context of 1012	4776	spoolsv.exe	207
PID 3684 set thread context of 3940	3684	spoolsv.exe	210
PID 2864 set thread context of 3480	2864	explorer.exe	212
PID 3992 set thread context of 3148	3992	spoolsv.exe	213
PID 2056 set thread context of 1132	2056	spoolsv.exe	214

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3160	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
2484	spoolsv.exe
2484	spoolsv.exe
1648	spoolsv.exe
1648	spoolsv.exe
2232	spoolsv.exe
2232	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
4724	spoolsv.exe
4724	spoolsv.exe
1176	spoolsv.exe
1176	spoolsv.exe
2480	spoolsv.exe
2480	spoolsv.exe
2372	spoolsv.exe
2372	spoolsv.exe
4512	spoolsv.exe
4512	spoolsv.exe
2260	spoolsv.exe
2260	spoolsv.exe
3516	spoolsv.exe
3516	spoolsv.exe
4320	spoolsv.exe
4320	spoolsv.exe
2164	spoolsv.exe
2164	spoolsv.exe
3496	spoolsv.exe
3496	spoolsv.exe
3868	spoolsv.exe
3868	spoolsv.exe
2092	spoolsv.exe
2092	spoolsv.exe
736	spoolsv.exe
736	spoolsv.exe
1036	spoolsv.exe
1036	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
5116	spoolsv.exe
5116	spoolsv.exe
4584	spoolsv.exe
4584	spoolsv.exe
3892	spoolsv.exe
3892	spoolsv.exe
3680	spoolsv.exe
3680	spoolsv.exe
4272	spoolsv.exe
4272	spoolsv.exe
4912	spoolsv.exe
4912	spoolsv.exe
4604	spoolsv.exe
4604	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4172	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	81
PID 1932 wrote to memory of 4172	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	81
PID 1932 wrote to memory of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 1932 wrote to memory of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 1932 wrote to memory of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 1932 wrote to memory of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 1932 wrote to memory of 556	1932	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	86
PID 556 wrote to memory of 4524	556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	87
PID 556 wrote to memory of 4524	556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	87
PID 556 wrote to memory of 4524	556	a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe	87
PID 4524 wrote to memory of 3160	4524	explorer.exe	95
PID 4524 wrote to memory of 3160	4524	explorer.exe	95
PID 4524 wrote to memory of 3160	4524	explorer.exe	95
PID 4524 wrote to memory of 3160	4524	explorer.exe	95
PID 4524 wrote to memory of 3160	4524	explorer.exe	95
PID 3160 wrote to memory of 412	3160	explorer.exe	96
PID 3160 wrote to memory of 412	3160	explorer.exe	96
PID 3160 wrote to memory of 412	3160	explorer.exe	96
PID 3160 wrote to memory of 816	3160	explorer.exe	97
PID 3160 wrote to memory of 816	3160	explorer.exe	97
PID 3160 wrote to memory of 816	3160	explorer.exe	97
PID 3160 wrote to memory of 1716	3160	explorer.exe	98
PID 3160 wrote to memory of 1716	3160	explorer.exe	98
PID 3160 wrote to memory of 1716	3160	explorer.exe	98
PID 3160 wrote to memory of 1152	3160	explorer.exe	99
PID 3160 wrote to memory of 1152	3160	explorer.exe	99
PID 3160 wrote to memory of 1152	3160	explorer.exe	99
PID 3160 wrote to memory of 4588	3160	explorer.exe	100
PID 3160 wrote to memory of 4588	3160	explorer.exe	100
PID 3160 wrote to memory of 4588	3160	explorer.exe	100
PID 3160 wrote to memory of 1436	3160	explorer.exe	101
PID 3160 wrote to memory of 1436	3160	explorer.exe	101
PID 3160 wrote to memory of 1436	3160	explorer.exe	101
PID 3160 wrote to memory of 4996	3160	explorer.exe	102
PID 3160 wrote to memory of 4996	3160	explorer.exe	102
PID 3160 wrote to memory of 4996	3160	explorer.exe	102
PID 3160 wrote to memory of 4120	3160	explorer.exe	103
PID 3160 wrote to memory of 4120	3160	explorer.exe	103
PID 3160 wrote to memory of 4120	3160	explorer.exe	103
PID 3160 wrote to memory of 2256	3160	explorer.exe	104
PID 3160 wrote to memory of 2256	3160	explorer.exe	104
PID 3160 wrote to memory of 2256	3160	explorer.exe	104
PID 3160 wrote to memory of 4268	3160	explorer.exe	105
PID 3160 wrote to memory of 4268	3160	explorer.exe	105
PID 3160 wrote to memory of 4268	3160	explorer.exe	105
PID 3160 wrote to memory of 2400	3160	explorer.exe	106
PID 3160 wrote to memory of 2400	3160	explorer.exe	106
PID 3160 wrote to memory of 2400	3160	explorer.exe	106
PID 3160 wrote to memory of 4692	3160	explorer.exe	107
PID 3160 wrote to memory of 4692	3160	explorer.exe	107
PID 3160 wrote to memory of 4692	3160	explorer.exe	107
PID 3160 wrote to memory of 2296	3160	explorer.exe	108
PID 3160 wrote to memory of 2296	3160	explorer.exe	108
PID 3160 wrote to memory of 2296	3160	explorer.exe	108
PID 3160 wrote to memory of 4524	3160	explorer.exe	109
PID 3160 wrote to memory of 4524	3160	explorer.exe	109
PID 3160 wrote to memory of 4524	3160	explorer.exe	109
PID 3160 wrote to memory of 2352	3160	explorer.exe	110
PID 3160 wrote to memory of 2352	3160	explorer.exe	110
PID 3160 wrote to memory of 2352	3160	explorer.exe	110
PID 3160 wrote to memory of 1620	3160	explorer.exe	111
PID 3160 wrote to memory of 1620	3160	explorer.exe	111
PID 3160 wrote to memory of 1620	3160	explorer.exe	111
PID 3160 wrote to memory of 1500	3160	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4172
- C:\Users\Admin\AppData\Local\Temp\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a32873beb7c2c72a08ba6332603e9f05_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:556
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4320
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5024
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2864
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1012
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3940
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 38c09aaf8ed584a9aae581e45d3c447b31b84779d46275934fbf1e0ba8aa55f5
MD5 2b5214b5f62c87da78786ea647c6d8a8
SHA1 2ab7eebc0bd449fc74c17eb6d81220c16a13c681
SHA512 162960c250b38d6c41268e57741b2f21b86ed0c42eab1d6747dc48880f75440fbd8d5fed0571e16f4dc939937a5a635cb7e34a30e045884f3fad67daba20b7f2
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 348202675405bfbc360bca41dd42161463a9e332466540886adad476f9308d5f
MD5 3e80f53ccff9b7c7ebeef725b8187438
SHA1 85e03e53ee74c5e95653d04a0476e360924d33e7
SHA512 62cd00dab1c9ed3e330efde6c64c350804704a5924c0a7bf9e146f1f781b47c80f1214f233eba6161df8cf8242c7e2644a770400d6174874446586944acc4a78
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWww7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-846-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/412-2021-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/536-2112-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/556-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-51-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-92-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/556-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/632-4421-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/736-2537-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/816-2100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/816-1027-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1012-4908-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1012-5070-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-2744-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1056-5351-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1112-4901-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-1029-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1152-2121-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1176-2229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1176-2419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-1196-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1500-1879-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1512-4186-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-1878-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1648-2099-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1652-3614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1652-3526-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1668-2104-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1716-1028-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1716-2109-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1728-5413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1820-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1844-4805-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1932-52-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1932-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1932-48-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/1932-0-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/1960-4544-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2080-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2092-2526-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2232-2113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2256-1354-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2260-2330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2296-1748-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2352-1750-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2372-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2396-3018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2400-1553-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2480-2250-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2480-2247-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2484-2020-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2484-2195-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2740-3248-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3140-4325-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3148-5108-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-845-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3168-5323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3388-2019-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3480-5101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3480-5099-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3516-2340-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-4049-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-3927-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3680-2859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3692-3849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3868-2516-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3872-2125-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3940-5091-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3940-5284-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-3030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4120-1353-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4268-1552-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4272-2868-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4272-2871-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4320-2439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4320-2595-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-4687-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-5205-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4432-5338-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4524-111-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4524-1749-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4584-2689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-1195-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4604-3002-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4668-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4692-1554-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4724-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-3387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-3384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4912-2881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-1352-0x0000000000400000-0x00000000005D3000-memory.dmp

Download