pony | f01f8d359027d8d7c95f80cf9e0ead96483da34650215456ec74e15f10c1ec48

Analysis

max time kernel
145s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
Size

2.2MB
MD5

a3805a2691fc94cf84033a7a22edc452
SHA1

f3b3b983dbab0e8a87b895b04bf2aa44b8174f38
SHA256

f01f8d359027d8d7c95f80cf9e0ead96483da34650215456ec74e15f10c1ec48
SHA512

8ad340148d655df67a7a7c51b86565263085be6fd868deedadfb4aa6cae87f78f3dfd61a1c1aaf1e209d6a1f3517b95061ef4c73fc2c7c6a64cab2495726b1c9
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwQ

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2404	explorer.exe
3004	explorer.exe
304	spoolsv.exe
2820	spoolsv.exe
568	spoolsv.exe
1644	spoolsv.exe
2224	spoolsv.exe
2684	spoolsv.exe
2240	spoolsv.exe
2756	spoolsv.exe
1860	spoolsv.exe
2880	spoolsv.exe
1968	spoolsv.exe
2344	spoolsv.exe
2348	spoolsv.exe
2956	spoolsv.exe
2492	spoolsv.exe
884	spoolsv.exe
944	spoolsv.exe
3028	spoolsv.exe
768	spoolsv.exe
2272	spoolsv.exe
2600	spoolsv.exe
2480	spoolsv.exe
1760	spoolsv.exe
2060	spoolsv.exe
3056	spoolsv.exe
3040	spoolsv.exe
2716	spoolsv.exe
280	spoolsv.exe
2020	spoolsv.exe
1332	spoolsv.exe
2680	spoolsv.exe
1992	spoolsv.exe
2544	spoolsv.exe
964	spoolsv.exe
592	spoolsv.exe
984	spoolsv.exe
3044	spoolsv.exe
2608	spoolsv.exe
1720	spoolsv.exe
1940	spoolsv.exe
2112	spoolsv.exe
1724	spoolsv.exe
2748	spoolsv.exe
684	spoolsv.exe
692	spoolsv.exe
1056	spoolsv.exe
2832	spoolsv.exe
2376	spoolsv.exe
1748	spoolsv.exe
564	spoolsv.exe
1424	spoolsv.exe
2928	spoolsv.exe
2524	spoolsv.exe
612	spoolsv.exe
2092	spoolsv.exe
2136	spoolsv.exe
2256	explorer.exe
2860	spoolsv.exe
2596	spoolsv.exe
2808	spoolsv.exe
3068	spoolsv.exe
1364	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2404 set thread context of 3004	2404	explorer.exe	33
PID 304 set thread context of 2136	304	spoolsv.exe	89
PID 2820 set thread context of 2860	2820	spoolsv.exe	91
PID 1644 set thread context of 2596	1644	spoolsv.exe	92
PID 568 set thread context of 3068	568	spoolsv.exe	94
PID 2684 set thread context of 1364	2684	spoolsv.exe	95
PID 2224 set thread context of 432	2224	spoolsv.exe	96
PID 2756 set thread context of 3096	2756	spoolsv.exe	97
PID 2880 set thread context of 3420	2880	spoolsv.exe	99
PID 2240 set thread context of 3444	2240	spoolsv.exe	100
PID 2344 set thread context of 3580	2344	spoolsv.exe	101
PID 1860 set thread context of 3588	1860	spoolsv.exe	102
PID 2956 set thread context of 3644	2956	spoolsv.exe	104
PID 1968 set thread context of 3636	1968	spoolsv.exe	103
PID 2348 set thread context of 3752	2348	spoolsv.exe	106
PID 612 set thread context of 3784	612	spoolsv.exe	107
PID 2492 set thread context of 3796	2492	spoolsv.exe	108
PID 884 set thread context of 3820	884	spoolsv.exe	109
PID 3028 set thread context of 3876	3028	spoolsv.exe	110
PID 2060 set thread context of 3900	2060	spoolsv.exe	111
PID 2272 set thread context of 3948	2272	spoolsv.exe	113
PID 768 set thread context of 3940	768	spoolsv.exe	112
PID 944 set thread context of 3968	944	spoolsv.exe	114
PID 2480 set thread context of 4028	2480	spoolsv.exe	115
PID 2600 set thread context of 4088	2600	spoolsv.exe	116
PID 280 set thread context of 3204	280	spoolsv.exe	118
PID 3040 set thread context of 1768	3040	spoolsv.exe	117
PID 1760 set thread context of 2852	1760	spoolsv.exe	119
PID 984 set thread context of 1668	984	spoolsv.exe	123
PID 964 set thread context of 2352	964	spoolsv.exe	120
PID 1992 set thread context of 1972	1992	spoolsv.exe	122
PID 2020 set thread context of 2456	2020	spoolsv.exe	124
PID 1332 set thread context of 3624	1332	spoolsv.exe	121
PID 2608 set thread context of 3708	2608	spoolsv.exe	128
PID 1940 set thread context of 3700	1940	spoolsv.exe	127
PID 3056 set thread context of 3664	3056	spoolsv.exe	126
PID 684 set thread context of 3760	684	spoolsv.exe	130
PID 2716 set thread context of 3676	2716	spoolsv.exe	125
PID 1724 set thread context of 3776	1724	spoolsv.exe	133
PID 3044 set thread context of 3768	3044	spoolsv.exe	131
PID 2544 set thread context of 3728	2544	spoolsv.exe	129
PID 2680 set thread context of 3416	2680	spoolsv.exe	132

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
3004	explorer.exe
2136	spoolsv.exe
2136	spoolsv.exe
2860	spoolsv.exe
2596	spoolsv.exe
3068	spoolsv.exe
1364	spoolsv.exe
2860	spoolsv.exe
432	spoolsv.exe
432	spoolsv.exe
3096	spoolsv.exe
1364	spoolsv.exe
2596	spoolsv.exe
3068	spoolsv.exe
3096	spoolsv.exe
3420	spoolsv.exe
3444	spoolsv.exe
3444	spoolsv.exe
3420	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe
3636	spoolsv.exe
3636	spoolsv.exe
3948	spoolsv.exe
3948	spoolsv.exe
3752	spoolsv.exe
3752	spoolsv.exe
3784	spoolsv.exe
3784	spoolsv.exe
3796	spoolsv.exe
3796	spoolsv.exe
3940	spoolsv.exe
3940	spoolsv.exe
3588	spoolsv.exe
3588	spoolsv.exe
3968	spoolsv.exe
3820	spoolsv.exe
3876	spoolsv.exe
3900	spoolsv.exe
3968	spoolsv.exe
4028	spoolsv.exe
3876	spoolsv.exe
3900	spoolsv.exe
4028	spoolsv.exe
3820	spoolsv.exe
3580	spoolsv.exe
3580	spoolsv.exe
4088	spoolsv.exe
4088	spoolsv.exe
3204	spoolsv.exe
1768	spoolsv.exe
3204	spoolsv.exe
1768	spoolsv.exe
2852	spoolsv.exe
2852	spoolsv.exe
1668	spoolsv.exe
1668	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1520	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	28
PID 2240 wrote to memory of 1520	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2452	2240	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2404	2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2404	2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2404	2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2404	2452	a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe	32
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 2404 wrote to memory of 3004	2404	explorer.exe	33
PID 3004 wrote to memory of 304	3004	explorer.exe	34
PID 3004 wrote to memory of 304	3004	explorer.exe	34
PID 3004 wrote to memory of 304	3004	explorer.exe	34
PID 3004 wrote to memory of 304	3004	explorer.exe	34
PID 3004 wrote to memory of 2820	3004	explorer.exe	35
PID 3004 wrote to memory of 2820	3004	explorer.exe	35
PID 3004 wrote to memory of 2820	3004	explorer.exe	35
PID 3004 wrote to memory of 2820	3004	explorer.exe	35
PID 3004 wrote to memory of 568	3004	explorer.exe	36
PID 3004 wrote to memory of 568	3004	explorer.exe	36
PID 3004 wrote to memory of 568	3004	explorer.exe	36
PID 3004 wrote to memory of 568	3004	explorer.exe	36
PID 3004 wrote to memory of 1644	3004	explorer.exe	37
PID 3004 wrote to memory of 1644	3004	explorer.exe	37
PID 3004 wrote to memory of 1644	3004	explorer.exe	37
PID 3004 wrote to memory of 1644	3004	explorer.exe	37
PID 3004 wrote to memory of 2224	3004	explorer.exe	38
PID 3004 wrote to memory of 2224	3004	explorer.exe	38
PID 3004 wrote to memory of 2224	3004	explorer.exe	38
PID 3004 wrote to memory of 2224	3004	explorer.exe	38
PID 3004 wrote to memory of 2684	3004	explorer.exe	39
PID 3004 wrote to memory of 2684	3004	explorer.exe	39
PID 3004 wrote to memory of 2684	3004	explorer.exe	39
PID 3004 wrote to memory of 2684	3004	explorer.exe	39
PID 3004 wrote to memory of 2240	3004	explorer.exe	40
PID 3004 wrote to memory of 2240	3004	explorer.exe	40
PID 3004 wrote to memory of 2240	3004	explorer.exe	40
PID 3004 wrote to memory of 2240	3004	explorer.exe	40
PID 3004 wrote to memory of 2756	3004	explorer.exe	41
PID 3004 wrote to memory of 2756	3004	explorer.exe	41
PID 3004 wrote to memory of 2756	3004	explorer.exe	41
PID 3004 wrote to memory of 2756	3004	explorer.exe	41
PID 3004 wrote to memory of 1860	3004	explorer.exe	42
PID 3004 wrote to memory of 1860	3004	explorer.exe	42
PID 3004 wrote to memory of 1860	3004	explorer.exe	42
PID 3004 wrote to memory of 1860	3004	explorer.exe	42
PID 3004 wrote to memory of 2880	3004	explorer.exe	43
PID 3004 wrote to memory of 2880	3004	explorer.exe	43
PID 3004 wrote to memory of 2880	3004	explorer.exe	43
PID 3004 wrote to memory of 2880	3004	explorer.exe	43
PID 3004 wrote to memory of 1968	3004	explorer.exe	44
PID 3004 wrote to memory of 1968	3004	explorer.exe	44
PID 3004 wrote to memory of 1968	3004	explorer.exe	44
PID 3004 wrote to memory of 1968	3004	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3805a2691fc94cf84033a7a22edc452_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2452
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
994cc29490ff3d1e02d4deb77aa07642

SHA1
d1a900765fef050615366a633bd70ef67f22637e

SHA256
8d5a42392bb6affc02b6a02193b855cd99bc77f8a467a2641bd57fc199f3bc32

SHA512
e0dda9cf5b59591e2d8e0845346a32f0962f8bc749f123396d9384a2cdf7b6e6eadb395a14a93e0d4a29971dbf3184e62c90ed308b7fbb78c1c85ed32c10f81d

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
73ed4d6961471ccc5fb94e73635f0272

SHA1
c5ec8c2383f1709429cd62b2b5b547aa21cd0d6e

SHA256
95be8443826267805b3a2df6a6b23b1de9e58db458524eeee475f793b22fe0e4

SHA512
1e7a24d166e3f7af76cdfe96f3521c8707c38dc94d155eacae12478e582e9313edbef0644844688b438ef192f1c0c953a3d46da335d161ee52f96dde874acac9

Download Submit
memory/280-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/304-1026-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/432-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/568-1028-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/768-1777-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/884-1595-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/944-1596-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1332-2258-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1644-1234-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1668-2826-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1760-1789-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1860-1438-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1968-1440-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2020-1980-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2060-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2136-2285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-2360-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2204-2991-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-1235-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-17-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2240-1436-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-19-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2240-29-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2272-1781-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2344-1591-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2348-1592-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2404-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2404-71-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2404-61-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2452-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-28-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2452-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2452-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2452-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2480-1788-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2492-1594-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-2500-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2600-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2684-1236-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2756-1437-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2820-1027-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2860-2339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-2578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2880-1439-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2944-2997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-1593-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3004-1020-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-1775-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3040-1977-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3056-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3068-2607-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3096-2597-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3420-2608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3444-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3588-2631-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3636-2610-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-2614-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-2873-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-2915-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3760-2878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3796-2650-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3820-2644-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3852-2953-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3876-2692-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3900-2651-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3912-3030-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-2628-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3948-2625-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4028-2643-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download