pony | 37cee9b60f20a377f77c62ddc356fe0e83eeed562873c8d3434b5692117180d5

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
Size 2.2MB
Sample240613-fdvchsybmk
SHA256 37cee9b60f20a377f77c62ddc356fe0e83eeed562873c8d3434b5692117180d5
MD5 a3dcf29c020270acef096c970a230a26
SHA1 48cf9c026312441dda754b60a1b2e37087155d3d
SHA512 71dbfccda888213a0ef2c3dfcc44e293568b40a209e877ca96c44a4ec09ff8feb3c347b635e055820b171b6a6de45e2871eff8e5a87a138a5765d3e016849193
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1208	explorer.exe
4436	explorer.exe
2164	spoolsv.exe
3600	spoolsv.exe
3424	spoolsv.exe
3136	spoolsv.exe
608	spoolsv.exe
2156	spoolsv.exe
4300	spoolsv.exe
2128	spoolsv.exe
2884	spoolsv.exe
3124	spoolsv.exe
3568	spoolsv.exe
3592	spoolsv.exe
3748	spoolsv.exe
4616	spoolsv.exe
3420	spoolsv.exe
4772	spoolsv.exe
2028	spoolsv.exe
4384	spoolsv.exe
1596	spoolsv.exe
2544	spoolsv.exe
4864	spoolsv.exe
3300	spoolsv.exe
1396	spoolsv.exe
392	spoolsv.exe
4608	spoolsv.exe
4504	spoolsv.exe
872	spoolsv.exe
4736	spoolsv.exe
2392	spoolsv.exe
4472	spoolsv.exe
1216	explorer.exe
1248	spoolsv.exe
692	spoolsv.exe
3788	spoolsv.exe
3500	spoolsv.exe
244	spoolsv.exe
4976	spoolsv.exe
2844	spoolsv.exe
3432	explorer.exe
2368	spoolsv.exe
2172	spoolsv.exe
892	spoolsv.exe
4792	spoolsv.exe
2604	spoolsv.exe
2812	explorer.exe
3620	spoolsv.exe
3176	spoolsv.exe
3904	spoolsv.exe
4468	spoolsv.exe
3264	explorer.exe
216	spoolsv.exe
396	spoolsv.exe
1448	spoolsv.exe
1956	spoolsv.exe
3368	spoolsv.exe
3444	spoolsv.exe
1280	explorer.exe
2320	spoolsv.exe
1868	spoolsv.exe
3256	spoolsv.exe
2448	spoolsv.exe
2208	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 1208 set thread context of 4436	1208	explorer.exe	96
PID 2164 set thread context of 4472	2164	spoolsv.exe	126
PID 3600 set thread context of 1248	3600	spoolsv.exe	128
PID 3424 set thread context of 692	3424	spoolsv.exe	129
PID 3136 set thread context of 3788	3136	spoolsv.exe	130
PID 608 set thread context of 3500	608	spoolsv.exe	131
PID 2156 set thread context of 4976	2156	spoolsv.exe	133
PID 4300 set thread context of 2844	4300	spoolsv.exe	134
PID 2128 set thread context of 2368	2128	spoolsv.exe	136
PID 2884 set thread context of 2172	2884	spoolsv.exe	137
PID 3124 set thread context of 4792	3124	spoolsv.exe	139
PID 3568 set thread context of 2604	3568	spoolsv.exe	140
PID 3592 set thread context of 3620	3592	spoolsv.exe	142
PID 3748 set thread context of 3176	3748	spoolsv.exe	143
PID 4616 set thread context of 4468	4616	spoolsv.exe	145
PID 3420 set thread context of 216	3420	spoolsv.exe	147
PID 4772 set thread context of 396	4772	spoolsv.exe	148
PID 2028 set thread context of 1448	2028	spoolsv.exe	149
PID 4384 set thread context of 1956	4384	spoolsv.exe	150
PID 1596 set thread context of 3444	1596	spoolsv.exe	152
PID 2544 set thread context of 2320	2544	spoolsv.exe	154
PID 4864 set thread context of 1868	4864	spoolsv.exe	155
PID 3300 set thread context of 2448	3300	spoolsv.exe	157
PID 1396 set thread context of 4152	1396	spoolsv.exe	159
PID 392 set thread context of 1728	392	spoolsv.exe	160
PID 4608 set thread context of 440	4608	spoolsv.exe	162
PID 4504 set thread context of 2444	4504	spoolsv.exe	163
PID 872 set thread context of 1404	872	spoolsv.exe	165
PID 4736 set thread context of 4740	4736	spoolsv.exe	167
PID 2392 set thread context of 5048	2392	spoolsv.exe	172
PID 1216 set thread context of 4636	1216	explorer.exe	174
PID 244 set thread context of 2972	244	spoolsv.exe	178
PID 3432 set thread context of 512	3432	explorer.exe	180
PID 892 set thread context of 3856	892	spoolsv.exe	182
PID 2812 set thread context of 3164	2812	explorer.exe	184
PID 3904 set thread context of 4208	3904	spoolsv.exe	189
PID 3264 set thread context of 2360	3264	explorer.exe	191
PID 3368 set thread context of 3220	3368	spoolsv.exe	193
PID 1280 set thread context of 4136	1280	explorer.exe	195
PID 3256 set thread context of 2052	3256	spoolsv.exe	198
PID 2208 set thread context of 3812	2208	explorer.exe	201
PID 4400 set thread context of 2860	4400	spoolsv.exe	202
PID 4876 set thread context of 3128	4876	explorer.exe	204
PID 2060 set thread context of 3732	2060	spoolsv.exe	206
PID 3324 set thread context of 3540	3324	explorer.exe	207
PID 864 set thread context of 4744	864	spoolsv.exe	208
PID 2332 set thread context of 3956	2332	spoolsv.exe	209
PID 552 set thread context of 408	552	spoolsv.exe	211
PID 2624 set thread context of 808	2624	explorer.exe	213
PID 3780 set thread context of 4156	3780	spoolsv.exe	214
PID 4548 set thread context of 456	4548	spoolsv.exe	216
PID 4256 set thread context of 3992	4256	spoolsv.exe	219
PID 3052 set thread context of 2436	3052	explorer.exe	221

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4436	explorer.exe
4472	spoolsv.exe
4472	spoolsv.exe
1248	spoolsv.exe
1248	spoolsv.exe
692	spoolsv.exe
692	spoolsv.exe
3788	spoolsv.exe
3788	spoolsv.exe
3500	spoolsv.exe
3500	spoolsv.exe
4976	spoolsv.exe
4976	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
2368	spoolsv.exe
2368	spoolsv.exe
2172	spoolsv.exe
2172	spoolsv.exe
4792	spoolsv.exe
4792	spoolsv.exe
2604	spoolsv.exe
2604	spoolsv.exe
3620	spoolsv.exe
3620	spoolsv.exe
3176	spoolsv.exe
3176	spoolsv.exe
4468	spoolsv.exe
4468	spoolsv.exe
216	spoolsv.exe
216	spoolsv.exe
396	spoolsv.exe
396	spoolsv.exe
1448	spoolsv.exe
1448	spoolsv.exe
1956	spoolsv.exe
1956	spoolsv.exe
3444	spoolsv.exe
3444	spoolsv.exe
2320	spoolsv.exe
2320	spoolsv.exe
1868	spoolsv.exe
1868	spoolsv.exe
2448	spoolsv.exe
2448	spoolsv.exe
4152	spoolsv.exe
4152	spoolsv.exe
1728	spoolsv.exe
1728	spoolsv.exe
440	spoolsv.exe
440	spoolsv.exe
2444	spoolsv.exe
2444	spoolsv.exe
1404	spoolsv.exe
1404	spoolsv.exe
4740	spoolsv.exe
4740	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 224	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	82
PID 4952 wrote to memory of 224	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	82
PID 4952 wrote to memory of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 4952 wrote to memory of 1052	4952	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	87
PID 1052 wrote to memory of 1208	1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	88
PID 1052 wrote to memory of 1208	1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	88
PID 1052 wrote to memory of 1208	1052	a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe	88
PID 1208 wrote to memory of 4436	1208	explorer.exe	96
PID 1208 wrote to memory of 4436	1208	explorer.exe	96
PID 1208 wrote to memory of 4436	1208	explorer.exe	96
PID 1208 wrote to memory of 4436	1208	explorer.exe	96
PID 1208 wrote to memory of 4436	1208	explorer.exe	96
PID 4436 wrote to memory of 2164	4436	explorer.exe	97
PID 4436 wrote to memory of 2164	4436	explorer.exe	97
PID 4436 wrote to memory of 2164	4436	explorer.exe	97
PID 4436 wrote to memory of 3600	4436	explorer.exe	98
PID 4436 wrote to memory of 3600	4436	explorer.exe	98
PID 4436 wrote to memory of 3600	4436	explorer.exe	98
PID 4436 wrote to memory of 3424	4436	explorer.exe	99
PID 4436 wrote to memory of 3424	4436	explorer.exe	99
PID 4436 wrote to memory of 3424	4436	explorer.exe	99
PID 4436 wrote to memory of 3136	4436	explorer.exe	100
PID 4436 wrote to memory of 3136	4436	explorer.exe	100
PID 4436 wrote to memory of 3136	4436	explorer.exe	100
PID 4436 wrote to memory of 608	4436	explorer.exe	101
PID 4436 wrote to memory of 608	4436	explorer.exe	101
PID 4436 wrote to memory of 608	4436	explorer.exe	101
PID 4436 wrote to memory of 2156	4436	explorer.exe	102
PID 4436 wrote to memory of 2156	4436	explorer.exe	102
PID 4436 wrote to memory of 2156	4436	explorer.exe	102
PID 4436 wrote to memory of 4300	4436	explorer.exe	103
PID 4436 wrote to memory of 4300	4436	explorer.exe	103
PID 4436 wrote to memory of 4300	4436	explorer.exe	103
PID 4436 wrote to memory of 2128	4436	explorer.exe	104
PID 4436 wrote to memory of 2128	4436	explorer.exe	104
PID 4436 wrote to memory of 2128	4436	explorer.exe	104
PID 4436 wrote to memory of 2884	4436	explorer.exe	105
PID 4436 wrote to memory of 2884	4436	explorer.exe	105
PID 4436 wrote to memory of 2884	4436	explorer.exe	105
PID 4436 wrote to memory of 3124	4436	explorer.exe	106
PID 4436 wrote to memory of 3124	4436	explorer.exe	106
PID 4436 wrote to memory of 3124	4436	explorer.exe	106
PID 4436 wrote to memory of 3568	4436	explorer.exe	107
PID 4436 wrote to memory of 3568	4436	explorer.exe	107
PID 4436 wrote to memory of 3568	4436	explorer.exe	107
PID 4436 wrote to memory of 3592	4436	explorer.exe	108
PID 4436 wrote to memory of 3592	4436	explorer.exe	108
PID 4436 wrote to memory of 3592	4436	explorer.exe	108
PID 4436 wrote to memory of 3748	4436	explorer.exe	109
PID 4436 wrote to memory of 3748	4436	explorer.exe	109
PID 4436 wrote to memory of 3748	4436	explorer.exe	109
PID 4436 wrote to memory of 4616	4436	explorer.exe	110
PID 4436 wrote to memory of 4616	4436	explorer.exe	110
PID 4436 wrote to memory of 4616	4436	explorer.exe	110
PID 4436 wrote to memory of 3420	4436	explorer.exe	111
PID 4436 wrote to memory of 3420	4436	explorer.exe	111
PID 4436 wrote to memory of 3420	4436	explorer.exe	111
PID 4436 wrote to memory of 4772	4436	explorer.exe	112
PID 4436 wrote to memory of 4772	4436	explorer.exe	112
PID 4436 wrote to memory of 4772	4436	explorer.exe	112
PID 4436 wrote to memory of 2028	4436	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:224
- C:\Users\Admin\AppData\Local\Temp\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3dcf29c020270acef096c970a230a26_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1216
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3432
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2812
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3264
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1280
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2208
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4876
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2624
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:408
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 cd99047a6d98f336efa097efd2999f3438323085ff92ca94dc331ee1fd70be3f
MD5 38dbe02314abbc87b45e237b4706d6d0
SHA1 7a321cfcc1fc496225d88664be809f9a0ad00f7f
SHA512 bc4ed7ac9f29a85f58f5ad668b44f80cc7486f9e1f88044a25726a6da27707aeae09a680db93d44d18489dec7d4d08d69bff8f4f9444469e9b84f31c4a5ad129
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 2796aafe6a942fe480ac79124e65102ca345f40386e1e17dda246c92dadcd171
MD5 1b5fab81255ce00d24ead8ba25bd2e4c
SHA1 98804bc2eb7720ac006c92614ef1fb0ec9a59bbd
SHA512 e7f089825105b153f17237e7329be0ce790bbca6fc6009d32841d425d653b0635a84b3167b2578cc7ca77f8d1512092b133fa4b42ef5faa4e42f5d7121e7177f
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-2433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-4782-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-4917-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/440-2859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/456-4873-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/512-3618-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/608-1094-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/692-1908-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/692-1911-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-68-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-67-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1052-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1208-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1208-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1248-1896-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1248-1900-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1404-2960-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-2452-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-1884-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1728-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1868-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2028-1736-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2052-4405-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2128-1287-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2156-1095-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2164-775-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2164-1886-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2172-2115-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2320-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2360-4137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2368-2102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2436-5095-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2436-5098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2444-2945-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2444-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-2903-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-2777-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-1895-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2604-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2604-2284-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-2093-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-2266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2860-4553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2884-1288-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2972-3607-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3124-1409-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3128-4636-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3136-908-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3136-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3164-3770-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3176-2303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-4339-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-4215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3300-1915-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3420-1734-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3424-1912-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3424-907-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3444-2757-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-2613-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-4656-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3568-1410-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3592-1608-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3600-906-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3600-1893-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3620-2296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3620-2292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-4644-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3748-1609-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3788-1922-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3812-4491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3856-3897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3856-3749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-4672-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-4674-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-5077-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-4226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-4224-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4152-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4208-4199-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4208-4128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-1286-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4384-1883-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4436-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4436-774-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-2596-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-2425-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-1885-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-2051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4616-1615-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4636-3388-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4740-3182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4772-1735-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4792-2195-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-1906-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4952-0-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/4952-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4952-38-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/4952-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4976-2077-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-2057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5048-3451-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5048-3328-0x0000000000400000-0x000000000043E000-memory.dmp

Download