pony | 458944505d171ac21ee2d8a3e5b879fbfe9c32d601e9c38df31e8767df5a4825

Analysis

max time kernel
149s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
Size 2.2MB
Sample240613-b2t97stbkk
SHA256 458944505d171ac21ee2d8a3e5b879fbfe9c32d601e9c38df31e8767df5a4825
MD5 a3660c19cd4bcdebcf7028593e962689
SHA1 dac984a13c0e66142e1a28d6ddc588634f6f4903
SHA512 1bb3982d7d5c48a319f58e48d6f43d401b2fdc2832067c76baa888d54d6504ba6e0fc2f12eb9e3649634f354d375ea8b5d3f52b6c606d7e004f63413f3f20801
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWww9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4672	explorer.exe
4420	explorer.exe
3368	spoolsv.exe
4524	spoolsv.exe
2012	spoolsv.exe
736	spoolsv.exe
3768	spoolsv.exe
2304	spoolsv.exe
5116	spoolsv.exe
1448	spoolsv.exe
2996	spoolsv.exe
2584	spoolsv.exe
3456	spoolsv.exe
4560	spoolsv.exe
1512	spoolsv.exe
2576	spoolsv.exe
4408	spoolsv.exe
2104	spoolsv.exe
4872	spoolsv.exe
4796	spoolsv.exe
3268	spoolsv.exe
4000	spoolsv.exe
3040	spoolsv.exe
3252	spoolsv.exe
4788	spoolsv.exe
1928	spoolsv.exe
3244	spoolsv.exe
1728	spoolsv.exe
1532	spoolsv.exe
3740	spoolsv.exe
4916	spoolsv.exe
4940	spoolsv.exe
4676	spoolsv.exe
1048	spoolsv.exe
5012	explorer.exe
1356	spoolsv.exe
3448	spoolsv.exe
1548	spoolsv.exe
2132	spoolsv.exe
940	spoolsv.exe
1640	spoolsv.exe
4672	explorer.exe
2448	spoolsv.exe
3472	spoolsv.exe
2352	spoolsv.exe
3076	spoolsv.exe
3780	spoolsv.exe
4388	explorer.exe
1244	spoolsv.exe
3808	spoolsv.exe
3468	spoolsv.exe
4372	spoolsv.exe
1664	spoolsv.exe
4064	spoolsv.exe
440	spoolsv.exe
1580	spoolsv.exe
3080	explorer.exe
5016	spoolsv.exe
5096	spoolsv.exe
3520	spoolsv.exe
1468	spoolsv.exe
4260	spoolsv.exe
2544	spoolsv.exe
4432	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 4672 set thread context of 4420	4672	explorer.exe	96
PID 3368 set thread context of 1048	3368	spoolsv.exe	128
PID 4524 set thread context of 1356	4524	spoolsv.exe	130
PID 2012 set thread context of 3448	2012	spoolsv.exe	131
PID 736 set thread context of 1548	736	spoolsv.exe	132
PID 3768 set thread context of 2132	3768	spoolsv.exe	133
PID 2304 set thread context of 1640	2304	spoolsv.exe	135
PID 5116 set thread context of 2448	5116	spoolsv.exe	137
PID 1448 set thread context of 3472	1448	spoolsv.exe	138
PID 2996 set thread context of 2352	2996	spoolsv.exe	139
PID 2584 set thread context of 3780	2584	spoolsv.exe	141
PID 3456 set thread context of 1244	3456	spoolsv.exe	143
PID 4560 set thread context of 3808	4560	spoolsv.exe	144
PID 1512 set thread context of 3468	1512	spoolsv.exe	145
PID 2576 set thread context of 4372	2576	spoolsv.exe	146
PID 4408 set thread context of 1664	4408	spoolsv.exe	147
PID 2104 set thread context of 4064	2104	spoolsv.exe	148
PID 4872 set thread context of 1580	4872	spoolsv.exe	150
PID 4796 set thread context of 5016	4796	spoolsv.exe	152
PID 3268 set thread context of 5096	3268	spoolsv.exe	153
PID 4000 set thread context of 3520	4000	spoolsv.exe	154
PID 3040 set thread context of 4260	3040	spoolsv.exe	156
PID 3252 set thread context of 2544	3252	spoolsv.exe	157
PID 4788 set thread context of 1932	4788	spoolsv.exe	159
PID 1928 set thread context of 2688	1928	spoolsv.exe	160
PID 3244 set thread context of 1924	3244	spoolsv.exe	161
PID 1728 set thread context of 3216	1728	spoolsv.exe	163
PID 1532 set thread context of 1832	1532	spoolsv.exe	164
PID 3740 set thread context of 5076	3740	spoolsv.exe	165
PID 4916 set thread context of 2728	4916	spoolsv.exe	167
PID 4940 set thread context of 1864	4940	spoolsv.exe	168
PID 4676 set thread context of 2168	4676	spoolsv.exe	172
PID 5012 set thread context of 3188	5012	explorer.exe	174
PID 940 set thread context of 3372	940	spoolsv.exe	178
PID 4672 set thread context of 5000	4672	explorer.exe	180
PID 3076 set thread context of 2452	3076	spoolsv.exe	186
PID 4388 set thread context of 4292	4388	explorer.exe	189
PID 440 set thread context of 4764	440	spoolsv.exe	193
PID 3080 set thread context of 4188	3080	explorer.exe	195
PID 1468 set thread context of 2800	1468	spoolsv.exe	200
PID 4432 set thread context of 3512	4432	explorer.exe	203
PID 884 set thread context of 8	884	spoolsv.exe	205
PID 620 set thread context of 2596	620	explorer.exe	207
PID 464 set thread context of 4944	464	spoolsv.exe	209
PID 216 set thread context of 2420	216	spoolsv.exe	210
PID 1656 set thread context of 4312	1656	spoolsv.exe	213
PID 3568 set thread context of 1000	3568	explorer.exe	215
PID 3904 set thread context of 5008	3904	spoolsv.exe	216
PID 4228 set thread context of 3788	4228	spoolsv.exe	218
PID 2024 set thread context of 4472	2024	spoolsv.exe	220
PID 5072 set thread context of 1912	5072	explorer.exe	222
PID 3420 set thread context of 2068	3420	spoolsv.exe	223
PID 2324 set thread context of 1472	2324	spoolsv.exe	224
PID 228 set thread context of 648	228	spoolsv.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4420	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
4420	explorer.exe
1048	spoolsv.exe
1048	spoolsv.exe
1356	spoolsv.exe
1356	spoolsv.exe
3448	spoolsv.exe
3448	spoolsv.exe
1548	spoolsv.exe
1548	spoolsv.exe
2132	spoolsv.exe
2132	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
2448	spoolsv.exe
2448	spoolsv.exe
3472	spoolsv.exe
3472	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
3780	spoolsv.exe
3780	spoolsv.exe
1244	spoolsv.exe
1244	spoolsv.exe
3808	spoolsv.exe
3808	spoolsv.exe
3468	spoolsv.exe
3468	spoolsv.exe
4372	spoolsv.exe
4372	spoolsv.exe
1664	spoolsv.exe
1664	spoolsv.exe
4064	spoolsv.exe
4064	spoolsv.exe
1580	spoolsv.exe
1580	spoolsv.exe
5016	spoolsv.exe
5016	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
3520	spoolsv.exe
3520	spoolsv.exe
4260	spoolsv.exe
4260	spoolsv.exe
2544	spoolsv.exe
2544	spoolsv.exe
1932	spoolsv.exe
1932	spoolsv.exe
2688	spoolsv.exe
2688	spoolsv.exe
1924	spoolsv.exe
1924	spoolsv.exe
3216	spoolsv.exe
3216	spoolsv.exe
1832	spoolsv.exe
1832	spoolsv.exe
5076	spoolsv.exe
5076	spoolsv.exe
2728	spoolsv.exe
2728	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	82
PID 1636 wrote to memory of 2540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	82
PID 1636 wrote to memory of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 1636 wrote to memory of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 1636 wrote to memory of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 1636 wrote to memory of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 1636 wrote to memory of 540	1636	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	87
PID 540 wrote to memory of 4672	540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	88
PID 540 wrote to memory of 4672	540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	88
PID 540 wrote to memory of 4672	540	a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe	88
PID 4672 wrote to memory of 4420	4672	explorer.exe	96
PID 4672 wrote to memory of 4420	4672	explorer.exe	96
PID 4672 wrote to memory of 4420	4672	explorer.exe	96
PID 4672 wrote to memory of 4420	4672	explorer.exe	96
PID 4672 wrote to memory of 4420	4672	explorer.exe	96
PID 4420 wrote to memory of 3368	4420	explorer.exe	97
PID 4420 wrote to memory of 3368	4420	explorer.exe	97
PID 4420 wrote to memory of 3368	4420	explorer.exe	97
PID 4420 wrote to memory of 4524	4420	explorer.exe	98
PID 4420 wrote to memory of 4524	4420	explorer.exe	98
PID 4420 wrote to memory of 4524	4420	explorer.exe	98
PID 4420 wrote to memory of 2012	4420	explorer.exe	99
PID 4420 wrote to memory of 2012	4420	explorer.exe	99
PID 4420 wrote to memory of 2012	4420	explorer.exe	99
PID 4420 wrote to memory of 736	4420	explorer.exe	100
PID 4420 wrote to memory of 736	4420	explorer.exe	100
PID 4420 wrote to memory of 736	4420	explorer.exe	100
PID 4420 wrote to memory of 3768	4420	explorer.exe	101
PID 4420 wrote to memory of 3768	4420	explorer.exe	101
PID 4420 wrote to memory of 3768	4420	explorer.exe	101
PID 4420 wrote to memory of 2304	4420	explorer.exe	102
PID 4420 wrote to memory of 2304	4420	explorer.exe	102
PID 4420 wrote to memory of 2304	4420	explorer.exe	102
PID 4420 wrote to memory of 5116	4420	explorer.exe	103
PID 4420 wrote to memory of 5116	4420	explorer.exe	103
PID 4420 wrote to memory of 5116	4420	explorer.exe	103
PID 4420 wrote to memory of 1448	4420	explorer.exe	104
PID 4420 wrote to memory of 1448	4420	explorer.exe	104
PID 4420 wrote to memory of 1448	4420	explorer.exe	104
PID 4420 wrote to memory of 2996	4420	explorer.exe	105
PID 4420 wrote to memory of 2996	4420	explorer.exe	105
PID 4420 wrote to memory of 2996	4420	explorer.exe	105
PID 4420 wrote to memory of 2584	4420	explorer.exe	106
PID 4420 wrote to memory of 2584	4420	explorer.exe	106
PID 4420 wrote to memory of 2584	4420	explorer.exe	106
PID 4420 wrote to memory of 3456	4420	explorer.exe	107
PID 4420 wrote to memory of 3456	4420	explorer.exe	107
PID 4420 wrote to memory of 3456	4420	explorer.exe	107
PID 4420 wrote to memory of 4560	4420	explorer.exe	108
PID 4420 wrote to memory of 4560	4420	explorer.exe	108
PID 4420 wrote to memory of 4560	4420	explorer.exe	108
PID 4420 wrote to memory of 1512	4420	explorer.exe	109
PID 4420 wrote to memory of 1512	4420	explorer.exe	109
PID 4420 wrote to memory of 1512	4420	explorer.exe	109
PID 4420 wrote to memory of 2576	4420	explorer.exe	110
PID 4420 wrote to memory of 2576	4420	explorer.exe	110
PID 4420 wrote to memory of 2576	4420	explorer.exe	110
PID 4420 wrote to memory of 4408	4420	explorer.exe	111
PID 4420 wrote to memory of 4408	4420	explorer.exe	111
PID 4420 wrote to memory of 4408	4420	explorer.exe	111
PID 4420 wrote to memory of 2104	4420	explorer.exe	112
PID 4420 wrote to memory of 2104	4420	explorer.exe	112
PID 4420 wrote to memory of 2104	4420	explorer.exe	112
PID 4420 wrote to memory of 4872	4420	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3660c19cd4bcdebcf7028593e962689_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4672
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3080
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4432
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:620
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3568
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:8
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2420
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 5346141b18752cb2e14fc30f0202c3133b33b44dfc260cfae65e915dca7a0724
MD5 ace46ee863e8b0bc7187723904fdfb1e
SHA1 143ddff152bf5344cbe6408b99f74e6e1a4f4057
SHA512 9e34fdcfdec4ba8173770a3ae255c5b468b3096f130c4fce6e6ce09d0c9e5c40173017e2eb5f08e2ee877d4ca22c2bf0cdf78613109b0945003c84f066ee37b5
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWwwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 54c310d2ac2ebf5c86e0efd01906e61bc0412c1a609981e8965cb8a91a0b7974
MD5 abec2aa0b9bd54a5d56c47e90244e504
SHA1 f880f0930b07aa40f76c404dd5340bc081c65638
SHA512 495c6d4eec16a0786ae5ec24be8f8f2c4dcfeef86627d2de8a6391ed5dfd86d1b1c0b97be65051b8ed92a21aeb8ed66e6b6c37a85dd3480b733f34cf50960686
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwws
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-4723-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/8-4847-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-99-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-97-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/648-5231-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/736-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/736-1053-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1000-5036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1048-2036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1048-2188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1244-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-2046-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-2043-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-1387-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1472-5219-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1512-1564-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1548-2069-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-2731-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-2574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1636-0-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/1636-43-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/1636-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1636-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1640-2206-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1640-2370-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1664-2440-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1664-2443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1864-3018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1912-5202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1924-2815-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1924-2812-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1932-2791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1932-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2012-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2012-1052-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2068-5208-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2104-1938-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2132-2080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2168-3245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2168-3371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-1230-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-5325-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2420-4894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-2215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-3869-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-2942-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-2785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2576-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2584-1389-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2596-4733-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2688-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-2992-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2728-2997-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2800-4626-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2800-4513-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2996-1388-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3040-2042-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3188-3254-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-2881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3252-2057-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3268-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3368-2032-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3368-925-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3372-3627-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3372-3501-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3448-2058-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3456-1562-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3468-2419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3472-2226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3512-4649-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3768-1229-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3780-2390-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3780-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3788-5103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4000-2035-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4064-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4188-4185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-2681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4292-3961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-5026-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-2431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4408-1754-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4420-109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4420-924-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-5190-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-1051-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4524-2047-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4560-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4672-110-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4672-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4764-4174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4764-4298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-1940-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4872-1939-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-4813-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-3514-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-3511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5096-2592-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5116-1231-0x0000000000400000-0x00000000005D3000-memory.dmp

Download