pony | 859eea625e7beacb15ee3463706ac582ea969fab6e11cd30b7113976ac4c899c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
Size 2.2MB
Sample240613-byme7azakd
SHA256 859eea625e7beacb15ee3463706ac582ea969fab6e11cd30b7113976ac4c899c
MD5 a360716fd94ac50cb3314d9cf9628e1b
SHA1 7ee1b827ca6d5c86d2b4f6c97d57fa31d8cbc132
SHA512 41f9facfffcbcc85025779f8b51831be19e870f0fcc6cfb22e494d328395adde572ba1e86e3041b73371876ef6fd5195e23ac25ab05e06582cb2c1579b216520
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4868	explorer.exe
4928	explorer.exe
1912	spoolsv.exe
1804	spoolsv.exe
4380	spoolsv.exe
3100	spoolsv.exe
4308	spoolsv.exe
3112	spoolsv.exe
1796	spoolsv.exe
3488	spoolsv.exe
4064	spoolsv.exe
4868	spoolsv.exe
4224	spoolsv.exe
4908	spoolsv.exe
1792	spoolsv.exe
384	spoolsv.exe
2532	spoolsv.exe
732	spoolsv.exe
2016	spoolsv.exe
2188	spoolsv.exe
372	spoolsv.exe
4492	spoolsv.exe
4528	spoolsv.exe
3040	spoolsv.exe
3640	spoolsv.exe
5072	spoolsv.exe
5084	spoolsv.exe
2644	spoolsv.exe
4200	spoolsv.exe
4392	spoolsv.exe
4032	spoolsv.exe
2316	spoolsv.exe
4956	spoolsv.exe
768	spoolsv.exe
628	spoolsv.exe
4560	explorer.exe
3124	spoolsv.exe
2088	spoolsv.exe
4548	spoolsv.exe
4404	spoolsv.exe
2548	spoolsv.exe
456	spoolsv.exe
2276	spoolsv.exe
3412	explorer.exe
1536	spoolsv.exe
3544	spoolsv.exe
4572	spoolsv.exe
2448	spoolsv.exe
3736	spoolsv.exe
2336	spoolsv.exe
2708	spoolsv.exe
4244	spoolsv.exe
3552	spoolsv.exe
3192	spoolsv.exe
1400	explorer.exe
4100	spoolsv.exe
4820	spoolsv.exe
4904	spoolsv.exe
1980	spoolsv.exe
1088	spoolsv.exe
3332	spoolsv.exe
1916	explorer.exe
1076	spoolsv.exe
3148	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 51 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4868 set thread context of 4928	4868	explorer.exe	92
PID 1912 set thread context of 628	1912	spoolsv.exe	125
PID 1804 set thread context of 3124	1804	spoolsv.exe	127
PID 4380 set thread context of 2088	4380	spoolsv.exe	128
PID 3100 set thread context of 4548	3100	spoolsv.exe	129
PID 4308 set thread context of 4404	4308	spoolsv.exe	130
PID 3112 set thread context of 2548	3112	spoolsv.exe	131
PID 1796 set thread context of 2276	1796	spoolsv.exe	133
PID 3488 set thread context of 1536	3488	spoolsv.exe	135
PID 4064 set thread context of 3544	4064	spoolsv.exe	136
PID 4868 set thread context of 4572	4868	spoolsv.exe	137
PID 4224 set thread context of 2448	4224	spoolsv.exe	138
PID 4908 set thread context of 3736	4908	spoolsv.exe	139
PID 1792 set thread context of 2336	1792	spoolsv.exe	140
PID 384 set thread context of 4244	384	spoolsv.exe	142
PID 2532 set thread context of 3552	2532	spoolsv.exe	143
PID 732 set thread context of 3192	732	spoolsv.exe	144
PID 2016 set thread context of 4100	2016	spoolsv.exe	146
PID 2188 set thread context of 4820	2188	spoolsv.exe	147
PID 372 set thread context of 4904	372	spoolsv.exe	148
PID 4492 set thread context of 1980	4492	spoolsv.exe	149
PID 4528 set thread context of 3332	4528	spoolsv.exe	151
PID 3040 set thread context of 1076	3040	spoolsv.exe	153
PID 3640 set thread context of 3148	3640	spoolsv.exe	154
PID 5072 set thread context of 4208	5072	spoolsv.exe	155
PID 5084 set thread context of 1356	5084	spoolsv.exe	157
PID 2644 set thread context of 4656	2644	spoolsv.exe	158
PID 4200 set thread context of 984	4200	spoolsv.exe	159
PID 4392 set thread context of 5024	4392	spoolsv.exe	161
PID 4032 set thread context of 4164	4032	spoolsv.exe	162
PID 2316 set thread context of 1632	2316	spoolsv.exe	164
PID 4956 set thread context of 2356	4956	spoolsv.exe	165
PID 768 set thread context of 2616	768	spoolsv.exe	171
PID 4560 set thread context of 1476	4560	explorer.exe	173
PID 456 set thread context of 3044	456	spoolsv.exe	178
PID 3412 set thread context of 4188	3412	explorer.exe	182
PID 2708 set thread context of 3984	2708	spoolsv.exe	186
PID 1400 set thread context of 1404	1400	explorer.exe	188
PID 1088 set thread context of 816	1088	spoolsv.exe	192
PID 1916 set thread context of 4740	1916	explorer.exe	196
PID 892 set thread context of 4328	892	spoolsv.exe	199
PID 4140 set thread context of 5052	4140	explorer.exe	202
PID 1528 set thread context of 4236	1528	spoolsv.exe	203
PID 2024 set thread context of 4596	2024	spoolsv.exe	204
PID 2788 set thread context of 1740	2788	explorer.exe	205
PID 1168 set thread context of 4832	1168	spoolsv.exe	206
PID 2144 set thread context of 3508	2144	spoolsv.exe	210
PID 4288 set thread context of 4796	4288	spoolsv.exe	212
PID 3920 set thread context of 4324	3920	explorer.exe	213
PID 4564 set thread context of 1032	4564	spoolsv.exe	215

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
4928	explorer.exe
628	spoolsv.exe
628	spoolsv.exe
3124	spoolsv.exe
3124	spoolsv.exe
2088	spoolsv.exe
2088	spoolsv.exe
4548	spoolsv.exe
4548	spoolsv.exe
4404	spoolsv.exe
4404	spoolsv.exe
2548	spoolsv.exe
2548	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
1536	spoolsv.exe
1536	spoolsv.exe
3544	spoolsv.exe
3544	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
2448	spoolsv.exe
2448	spoolsv.exe
3736	spoolsv.exe
3736	spoolsv.exe
2336	spoolsv.exe
2336	spoolsv.exe
4244	spoolsv.exe
4244	spoolsv.exe
3552	spoolsv.exe
3552	spoolsv.exe
3192	spoolsv.exe
3192	spoolsv.exe
4100	spoolsv.exe
4100	spoolsv.exe
4820	spoolsv.exe
4820	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
1980	spoolsv.exe
1980	spoolsv.exe
3332	spoolsv.exe
3332	spoolsv.exe
1076	spoolsv.exe
1076	spoolsv.exe
3148	spoolsv.exe
3148	spoolsv.exe
4208	spoolsv.exe
4208	spoolsv.exe
1356	spoolsv.exe
1356	spoolsv.exe
4656	spoolsv.exe
4656	spoolsv.exe
984	spoolsv.exe
984	spoolsv.exe
5024	spoolsv.exe
5024	spoolsv.exe
4164	spoolsv.exe
4164	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3220	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	82
PID 4656 wrote to memory of 3220	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	82
PID 4656 wrote to memory of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4656 wrote to memory of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4656 wrote to memory of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4656 wrote to memory of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4656 wrote to memory of 4812	4656	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	87
PID 4812 wrote to memory of 4868	4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	88
PID 4812 wrote to memory of 4868	4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	88
PID 4812 wrote to memory of 4868	4812	a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe	88
PID 4868 wrote to memory of 4928	4868	explorer.exe	92
PID 4868 wrote to memory of 4928	4868	explorer.exe	92
PID 4868 wrote to memory of 4928	4868	explorer.exe	92
PID 4868 wrote to memory of 4928	4868	explorer.exe	92
PID 4868 wrote to memory of 4928	4868	explorer.exe	92
PID 4928 wrote to memory of 1912	4928	explorer.exe	93
PID 4928 wrote to memory of 1912	4928	explorer.exe	93
PID 4928 wrote to memory of 1912	4928	explorer.exe	93
PID 4928 wrote to memory of 1804	4928	explorer.exe	94
PID 4928 wrote to memory of 1804	4928	explorer.exe	94
PID 4928 wrote to memory of 1804	4928	explorer.exe	94
PID 4928 wrote to memory of 4380	4928	explorer.exe	95
PID 4928 wrote to memory of 4380	4928	explorer.exe	95
PID 4928 wrote to memory of 4380	4928	explorer.exe	95
PID 4928 wrote to memory of 3100	4928	explorer.exe	96
PID 4928 wrote to memory of 3100	4928	explorer.exe	96
PID 4928 wrote to memory of 3100	4928	explorer.exe	96
PID 4928 wrote to memory of 4308	4928	explorer.exe	97
PID 4928 wrote to memory of 4308	4928	explorer.exe	97
PID 4928 wrote to memory of 4308	4928	explorer.exe	97
PID 4928 wrote to memory of 3112	4928	explorer.exe	98
PID 4928 wrote to memory of 3112	4928	explorer.exe	98
PID 4928 wrote to memory of 3112	4928	explorer.exe	98
PID 4928 wrote to memory of 1796	4928	explorer.exe	99
PID 4928 wrote to memory of 1796	4928	explorer.exe	99
PID 4928 wrote to memory of 1796	4928	explorer.exe	99
PID 4928 wrote to memory of 3488	4928	explorer.exe	100
PID 4928 wrote to memory of 3488	4928	explorer.exe	100
PID 4928 wrote to memory of 3488	4928	explorer.exe	100
PID 4928 wrote to memory of 4064	4928	explorer.exe	101
PID 4928 wrote to memory of 4064	4928	explorer.exe	101
PID 4928 wrote to memory of 4064	4928	explorer.exe	101
PID 4928 wrote to memory of 4868	4928	explorer.exe	102
PID 4928 wrote to memory of 4868	4928	explorer.exe	102
PID 4928 wrote to memory of 4868	4928	explorer.exe	102
PID 4928 wrote to memory of 4224	4928	explorer.exe	103
PID 4928 wrote to memory of 4224	4928	explorer.exe	103
PID 4928 wrote to memory of 4224	4928	explorer.exe	103
PID 4928 wrote to memory of 4908	4928	explorer.exe	104
PID 4928 wrote to memory of 4908	4928	explorer.exe	104
PID 4928 wrote to memory of 4908	4928	explorer.exe	104
PID 4928 wrote to memory of 1792	4928	explorer.exe	105
PID 4928 wrote to memory of 1792	4928	explorer.exe	105
PID 4928 wrote to memory of 1792	4928	explorer.exe	105
PID 4928 wrote to memory of 384	4928	explorer.exe	106
PID 4928 wrote to memory of 384	4928	explorer.exe	106
PID 4928 wrote to memory of 384	4928	explorer.exe	106
PID 4928 wrote to memory of 2532	4928	explorer.exe	107
PID 4928 wrote to memory of 2532	4928	explorer.exe	107
PID 4928 wrote to memory of 2532	4928	explorer.exe	107
PID 4928 wrote to memory of 732	4928	explorer.exe	108
PID 4928 wrote to memory of 732	4928	explorer.exe	108
PID 4928 wrote to memory of 732	4928	explorer.exe	108
PID 4928 wrote to memory of 2016	4928	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a360716fd94ac50cb3314d9cf9628e1b_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3412
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1400
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3332
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2356
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2788
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3984
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4832
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1032
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 5216a501a2576999088c03aa66362a19065ffd3d1354f9f76c5569295ca10cd9
MD5 36fbed8733d75d2c8d34e74dc17b3399
SHA1 1f083665806d1df5a00c9228862ec58d7e28e5c3
SHA512 72455d6c23cda3f70ac5eb122d82543cab00cf7b5b6c4b13cfcbcb9272f830cf08dfe686a3c06a64ce6fe039b6f9e2d154b68aa4d91112b93c4434192ef42685
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWww4
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 8e364b74d4828aa497259f4d7218ac4b2c13136716d74c1047e39ec29d6809d1
MD5 9b0e92a0ccc29e511357ceb62e52843e
SHA1 473ab8270193bda0f7883ce3d5796ccea053eae5
SHA512 0dfb31dc0352ccb27a4cf08ade57630a601fdb62f683d123f3cb8a8bdeb144d41fda4c7b5587f5fee5172a5efda55b2013544d189df44566e4e3a97d6b664bce
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZW:0UzeyQMS4DqodCnoe+iitjWwwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-1996-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/384-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/628-2136-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/628-2318-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/732-1860-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/816-4599-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/984-2951-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/984-3098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1032-5268-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1032-5409-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1076-2789-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-2891-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1404-4159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-3428-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1536-2350-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1608-5518-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1632-3054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1740-4961-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1792-1659-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1796-1257-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1804-2147-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1804-1067-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1912-881-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1912-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1980-2617-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2088-2157-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2188-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2276-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2336-2402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2356-3116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2356-3233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2392-5365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-2381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2532-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2548-2188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2616-3535-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2616-3420-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-2144-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3044-3905-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3044-3828-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3100-2164-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3100-1069-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3112-1256-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3124-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3148-2802-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3148-2798-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-2572-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-2745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3332-2935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3432-5529-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3432-5524-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-1458-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3508-5124-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3508-5242-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3544-2361-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3552-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3640-2156-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3736-2393-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-4302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-4149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4064-1459-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4188-3928-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4208-2818-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4208-2852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4224-1657-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4236-4941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-1255-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4324-5145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4324-5141-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-4825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-4989-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-1068-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4380-2158-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4404-2178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-2134-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4528-2135-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-2168-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4596-4955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4596-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4656-0-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/4656-33-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4656-28-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/4656-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4740-4669-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-32-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-70-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-68-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4820-2588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4832-5038-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4868-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4868-76-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4868-1460-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4904-2596-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4908-1658-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4928-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-880-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5024-2959-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5024-2962-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5052-4931-0x0000000000400000-0x000000000043E000-memory.dmp

Download