pony | d8932e5126eec5638e7f727b06f9947aad132798b79ce93739fec44537b3a1fd

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
Size 2.2MB
Sample240613-e9t6ysvbje
SHA256 d8932e5126eec5638e7f727b06f9947aad132798b79ce93739fec44537b3a1fd
MD5 a3d84e185b33aeda6191bb2cf05449f8
SHA1 0eff43e36b1ef6178f1863fc6659fe692efb4761
SHA512 f7bf1b38a8c8d4de3dbe52b2112f24d1e532c3deff95325fb1610924f685f07f6a6b9c354aaf1f2eb402ee81b41fe4202e1918a69007ad719d4aca4263693901
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3200	explorer.exe
376	explorer.exe
3288	spoolsv.exe
4944	spoolsv.exe
1628	spoolsv.exe
1764	spoolsv.exe
3732	spoolsv.exe
4480	spoolsv.exe
4060	spoolsv.exe
772	spoolsv.exe
3500	spoolsv.exe
3412	spoolsv.exe
648	spoolsv.exe
3032	spoolsv.exe
4996	spoolsv.exe
3508	spoolsv.exe
4540	spoolsv.exe
1708	spoolsv.exe
4472	spoolsv.exe
2028	spoolsv.exe
2020	spoolsv.exe
5028	spoolsv.exe
1880	spoolsv.exe
2532	spoolsv.exe
4848	spoolsv.exe
1300	spoolsv.exe
4536	spoolsv.exe
1048	spoolsv.exe
4484	spoolsv.exe
2520	spoolsv.exe
444	spoolsv.exe
4584	spoolsv.exe
4572	spoolsv.exe
2104	explorer.exe
1052	spoolsv.exe
1020	spoolsv.exe
3216	spoolsv.exe
2084	spoolsv.exe
3356	spoolsv.exe
4228	spoolsv.exe
4816	spoolsv.exe
3176	explorer.exe
2964	spoolsv.exe
840	spoolsv.exe
1872	spoolsv.exe
4260	spoolsv.exe
1720	spoolsv.exe
3936	spoolsv.exe
2792	explorer.exe
720	spoolsv.exe
4836	spoolsv.exe
3928	spoolsv.exe
2476	spoolsv.exe
3588	spoolsv.exe
1516	explorer.exe
3776	spoolsv.exe
3180	spoolsv.exe
4024	spoolsv.exe
4496	spoolsv.exe
2384	spoolsv.exe
5052	explorer.exe
3460	spoolsv.exe
3916	spoolsv.exe
1492	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 51 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 3200 set thread context of 376	3200	explorer.exe	92
PID 3288 set thread context of 4572	3288	spoolsv.exe	123
PID 4944 set thread context of 1052	4944	spoolsv.exe	125
PID 1628 set thread context of 1020	1628	spoolsv.exe	126
PID 1764 set thread context of 3216	1764	spoolsv.exe	127
PID 3732 set thread context of 2084	3732	spoolsv.exe	128
PID 4480 set thread context of 3356	4480	spoolsv.exe	129
PID 4060 set thread context of 4816	4060	spoolsv.exe	131
PID 772 set thread context of 2964	772	spoolsv.exe	133
PID 3500 set thread context of 840	3500	spoolsv.exe	134
PID 3412 set thread context of 1872	3412	spoolsv.exe	135
PID 648 set thread context of 1720	648	spoolsv.exe	137
PID 3032 set thread context of 3936	3032	spoolsv.exe	138
PID 4996 set thread context of 720	4996	spoolsv.exe	140
PID 3508 set thread context of 4836	3508	spoolsv.exe	141
PID 4540 set thread context of 2476	4540	spoolsv.exe	143
PID 1708 set thread context of 3588	1708	spoolsv.exe	144
PID 4472 set thread context of 3776	4472	spoolsv.exe	146
PID 2028 set thread context of 3180	2028	spoolsv.exe	147
PID 2020 set thread context of 4496	2020	spoolsv.exe	149
PID 5028 set thread context of 2384	5028	spoolsv.exe	150
PID 1880 set thread context of 3460	1880	spoolsv.exe	152
PID 2532 set thread context of 3916	2532	spoolsv.exe	153
PID 4848 set thread context of 1492	4848	spoolsv.exe	154
PID 1300 set thread context of 4600	1300	spoolsv.exe	156
PID 4536 set thread context of 3208	4536	spoolsv.exe	157
PID 1048 set thread context of 2176	1048	spoolsv.exe	159
PID 4484 set thread context of 876	4484	spoolsv.exe	160
PID 2520 set thread context of 4256	2520	spoolsv.exe	162
PID 444 set thread context of 4628	444	spoolsv.exe	163
PID 4584 set thread context of 3904	4584	spoolsv.exe	169
PID 2104 set thread context of 2712	2104	explorer.exe	171
PID 4228 set thread context of 1712	4228	spoolsv.exe	174
PID 3176 set thread context of 5112	3176	explorer.exe	176
PID 4260 set thread context of 4464	4260	spoolsv.exe	179
PID 2792 set thread context of 5092	2792	explorer.exe	181
PID 3928 set thread context of 1420	3928	spoolsv.exe	185
PID 1516 set thread context of 4760	1516	explorer.exe	187
PID 4024 set thread context of 3836	4024	spoolsv.exe	192
PID 5052 set thread context of 636	5052	explorer.exe	195
PID 3092 set thread context of 2084	3092	spoolsv.exe	198
PID 4684 set thread context of 4644	4684	explorer.exe	200
PID 2164 set thread context of 2928	2164	spoolsv.exe	202
PID 3036 set thread context of 1452	3036	explorer.exe	203
PID 3668 set thread context of 2852	3668	spoolsv.exe	205
PID 3096 set thread context of 4168	3096	spoolsv.exe	207
PID 2740 set thread context of 1876	2740	spoolsv.exe	209
PID 532 set thread context of 5020	532	spoolsv.exe	212
PID 2668 set thread context of 1664	2668	explorer.exe	214
PID 2496 set thread context of 2980	2496	spoolsv.exe	216

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
376	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
4572	spoolsv.exe
4572	spoolsv.exe
1052	spoolsv.exe
1052	spoolsv.exe
1020	spoolsv.exe
1020	spoolsv.exe
2084	spoolsv.exe
2084	spoolsv.exe
3356	spoolsv.exe
3356	spoolsv.exe
4816	spoolsv.exe
4816	spoolsv.exe
2964	spoolsv.exe
2964	spoolsv.exe
840	spoolsv.exe
840	spoolsv.exe
1872	spoolsv.exe
1872	spoolsv.exe
1720	spoolsv.exe
1720	spoolsv.exe
3936	spoolsv.exe
3936	spoolsv.exe
720	spoolsv.exe
720	spoolsv.exe
4836	spoolsv.exe
4836	spoolsv.exe
2476	spoolsv.exe
2476	spoolsv.exe
3588	spoolsv.exe
3588	spoolsv.exe
3776	spoolsv.exe
3776	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
4496	spoolsv.exe
4496	spoolsv.exe
2384	spoolsv.exe
2384	spoolsv.exe
3460	spoolsv.exe
3460	spoolsv.exe
3916	spoolsv.exe
3916	spoolsv.exe
1492	spoolsv.exe
1492	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe
3208	spoolsv.exe
3208	spoolsv.exe
2176	spoolsv.exe
2176	spoolsv.exe
876	spoolsv.exe
876	spoolsv.exe
4256	spoolsv.exe
4256	spoolsv.exe
4628	spoolsv.exe
4628	spoolsv.exe
3904	spoolsv.exe
3904	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3044	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	82
PID 992 wrote to memory of 3044	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	82
PID 992 wrote to memory of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 992 wrote to memory of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 992 wrote to memory of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 992 wrote to memory of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 992 wrote to memory of 4428	992	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	87
PID 4428 wrote to memory of 3200	4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	88
PID 4428 wrote to memory of 3200	4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	88
PID 4428 wrote to memory of 3200	4428	a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe	88
PID 3200 wrote to memory of 376	3200	explorer.exe	92
PID 3200 wrote to memory of 376	3200	explorer.exe	92
PID 3200 wrote to memory of 376	3200	explorer.exe	92
PID 3200 wrote to memory of 376	3200	explorer.exe	92
PID 3200 wrote to memory of 376	3200	explorer.exe	92
PID 376 wrote to memory of 3288	376	explorer.exe	93
PID 376 wrote to memory of 3288	376	explorer.exe	93
PID 376 wrote to memory of 3288	376	explorer.exe	93
PID 376 wrote to memory of 4944	376	explorer.exe	94
PID 376 wrote to memory of 4944	376	explorer.exe	94
PID 376 wrote to memory of 4944	376	explorer.exe	94
PID 376 wrote to memory of 1628	376	explorer.exe	95
PID 376 wrote to memory of 1628	376	explorer.exe	95
PID 376 wrote to memory of 1628	376	explorer.exe	95
PID 376 wrote to memory of 1764	376	explorer.exe	96
PID 376 wrote to memory of 1764	376	explorer.exe	96
PID 376 wrote to memory of 1764	376	explorer.exe	96
PID 376 wrote to memory of 3732	376	explorer.exe	97
PID 376 wrote to memory of 3732	376	explorer.exe	97
PID 376 wrote to memory of 3732	376	explorer.exe	97
PID 376 wrote to memory of 4480	376	explorer.exe	98
PID 376 wrote to memory of 4480	376	explorer.exe	98
PID 376 wrote to memory of 4480	376	explorer.exe	98
PID 376 wrote to memory of 4060	376	explorer.exe	99
PID 376 wrote to memory of 4060	376	explorer.exe	99
PID 376 wrote to memory of 4060	376	explorer.exe	99
PID 376 wrote to memory of 772	376	explorer.exe	100
PID 376 wrote to memory of 772	376	explorer.exe	100
PID 376 wrote to memory of 772	376	explorer.exe	100
PID 376 wrote to memory of 3500	376	explorer.exe	101
PID 376 wrote to memory of 3500	376	explorer.exe	101
PID 376 wrote to memory of 3500	376	explorer.exe	101
PID 376 wrote to memory of 3412	376	explorer.exe	102
PID 376 wrote to memory of 3412	376	explorer.exe	102
PID 376 wrote to memory of 3412	376	explorer.exe	102
PID 376 wrote to memory of 648	376	explorer.exe	103
PID 376 wrote to memory of 648	376	explorer.exe	103
PID 376 wrote to memory of 648	376	explorer.exe	103
PID 376 wrote to memory of 3032	376	explorer.exe	104
PID 376 wrote to memory of 3032	376	explorer.exe	104
PID 376 wrote to memory of 3032	376	explorer.exe	104
PID 376 wrote to memory of 4996	376	explorer.exe	105
PID 376 wrote to memory of 4996	376	explorer.exe	105
PID 376 wrote to memory of 4996	376	explorer.exe	105
PID 376 wrote to memory of 3508	376	explorer.exe	106
PID 376 wrote to memory of 3508	376	explorer.exe	106
PID 376 wrote to memory of 3508	376	explorer.exe	106
PID 376 wrote to memory of 4540	376	explorer.exe	107
PID 376 wrote to memory of 4540	376	explorer.exe	107
PID 376 wrote to memory of 4540	376	explorer.exe	107
PID 376 wrote to memory of 1708	376	explorer.exe	108
PID 376 wrote to memory of 1708	376	explorer.exe	108
PID 376 wrote to memory of 1708	376	explorer.exe	108
PID 376 wrote to memory of 4472	376	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3d84e185b33aeda6191bb2cf05449f8_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4428
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2104
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3176
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3036
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2668
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1420
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3836
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2084
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1876
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 6a518ae0ed163ddb3e2e92a7bd02f61c0b505d187fb89759369e176507711ec4
MD5 7613ea94f7a17e7734e0482edf1587df
SHA1 d9300793f8e59c3a1557e7552e091c03949b3993
SHA512 ed23a0711200e2c5add4345401f0b759f7dcc2e2bb82def288cfcfa235d16a57e7bf93be28a5583c4e4e15587f8aeb86ef372dec75cb2931809a3a1d1e9cd489
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 67afe996a19db9258f6683dd1fe6d83598cfa8495556136170a9837f69416c22
MD5 01774c44dba225f709e787223d5ed88e
SHA1 969f015e7f3638402b3938963f43c04e91bd4d93
SHA512 f5c7a29d57b172105bff7e01d65e7e06ab91abc69685bb6fef92231015c42fd82db5d0d1a412a6d683e301a20c7fc9ab93c75b86e0871e086f8b980ce5f9e68a
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-864-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/376-109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/636-4648-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/648-1606-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/720-2454-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/720-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-1407-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/840-2277-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-3013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/992-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/992-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/992-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/992-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1020-2093-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1020-2095-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-2081-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1316-5661-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1420-4201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-5642-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1452-4935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-2830-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-2085-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1628-1077-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1664-5400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1708-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1712-3692-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1712-3820-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1720-2353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1764-2099-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1764-1078-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1872-2289-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1876-5223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1876-5363-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1880-2079-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2020-2070-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2028-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-4834-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2084-2110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-3005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-3001-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2384-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2384-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2476-2581-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2532-2088-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2712-3540-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-3545-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-5129-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2928-4926-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2964-2266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2980-5534-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3032-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3200-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3200-110-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3208-2995-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-2102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3288-2073-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3288-865-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3356-2130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3412-1605-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3460-2805-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-1413-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3508-1822-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3588-2610-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-1254-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3776-2618-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3776-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3836-4555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3904-3533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3916-2814-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3916-2818-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3936-2447-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4052-5652-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4060-1256-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4168-5091-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4256-3091-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4256-3095-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-47-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-3904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4480-1255-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4496-2777-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-1823-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4572-2240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4600-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4600-2916-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-3196-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-4875-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-4210-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-2256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4836-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-2100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-2083-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4996-1821-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5020-5389-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-5503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-2071-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5092-3916-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5092-3913-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-3703-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-3698-0x0000000000400000-0x000000000043E000-memory.dmp

Download