pony | 014d5ee0b68aa666821c59d272849a0f7d80b56a8197526fd76fac54cd6e9c2e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
Size 2.2MB
Sample240613-fe1wpaybrj
SHA256 014d5ee0b68aa666821c59d272849a0f7d80b56a8197526fd76fac54cd6e9c2e
MD5 a3dea5adac1ef67cefa452276ca887be
SHA1 32a1b1f1e628afdb120a1a430338b21211c10cfb
SHA512 b08542eabe20af9fe29a170c9e6fa109c5e01df99d083460c2d799c2d95f516cc0b9d89e1971a5a609e0b91d07fbd857a26da74e41def9f4d34aa4ee85efc30b
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4004	explorer.exe
4496	explorer.exe
3440	spoolsv.exe
4720	spoolsv.exe
1444	spoolsv.exe
1844	spoolsv.exe
1756	spoolsv.exe
3104	spoolsv.exe
2252	spoolsv.exe
3968	spoolsv.exe
3080	spoolsv.exe
4312	spoolsv.exe
4432	spoolsv.exe
4972	spoolsv.exe
4360	spoolsv.exe
2812	spoolsv.exe
1520	spoolsv.exe
4172	spoolsv.exe
3344	spoolsv.exe
1912	spoolsv.exe
208	spoolsv.exe
5020	spoolsv.exe
4928	spoolsv.exe
4656	spoolsv.exe
3308	spoolsv.exe
2824	spoolsv.exe
3748	spoolsv.exe
872	spoolsv.exe
2632	spoolsv.exe
4968	spoolsv.exe
8	spoolsv.exe
1956	spoolsv.exe
1744	spoolsv.exe
4124	explorer.exe
2652	spoolsv.exe
4824	spoolsv.exe
1808	spoolsv.exe
2712	spoolsv.exe
4444	explorer.exe
4696	spoolsv.exe
1800	spoolsv.exe
5040	spoolsv.exe
4672	spoolsv.exe
3352	spoolsv.exe
4768	spoolsv.exe
5044	explorer.exe
1992	spoolsv.exe
5080	spoolsv.exe
4008	spoolsv.exe
1272	spoolsv.exe
4076	explorer.exe
1192	spoolsv.exe
1344	spoolsv.exe
60	spoolsv.exe
2232	spoolsv.exe
1392	spoolsv.exe
1548	spoolsv.exe
2028	explorer.exe
3088	spoolsv.exe
1692	spoolsv.exe
3428	spoolsv.exe
4380	spoolsv.exe
1208	spoolsv.exe
4560	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 3808 set thread context of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 4004 set thread context of 4496	4004	explorer.exe	92
PID 3440 set thread context of 1744	3440	spoolsv.exe	123
PID 4720 set thread context of 2652	4720	spoolsv.exe	125
PID 1444 set thread context of 1808	1444	spoolsv.exe	127
PID 1844 set thread context of 2712	1844	spoolsv.exe	128
PID 1756 set thread context of 4696	1756	spoolsv.exe	130
PID 3104 set thread context of 1800	3104	spoolsv.exe	131
PID 2252 set thread context of 5040	2252	spoolsv.exe	132
PID 3968 set thread context of 4672	3968	spoolsv.exe	133
PID 3080 set thread context of 4768	3080	spoolsv.exe	135
PID 4312 set thread context of 1992	4312	spoolsv.exe	137
PID 4432 set thread context of 5080	4432	spoolsv.exe	138
PID 4972 set thread context of 1272	4972	spoolsv.exe	140
PID 4360 set thread context of 1192	4360	spoolsv.exe	142
PID 2812 set thread context of 1344	2812	spoolsv.exe	143
PID 1520 set thread context of 60	1520	spoolsv.exe	144
PID 4172 set thread context of 1392	4172	spoolsv.exe	146
PID 3344 set thread context of 1548	3344	spoolsv.exe	147
PID 1912 set thread context of 3088	1912	spoolsv.exe	149
PID 208 set thread context of 1692	208	spoolsv.exe	150
PID 5020 set thread context of 3428	5020	spoolsv.exe	151
PID 4928 set thread context of 1208	4928	spoolsv.exe	153
PID 4656 set thread context of 1436	4656	spoolsv.exe	155
PID 3308 set thread context of 4760	3308	spoolsv.exe	156
PID 2824 set thread context of 4280	2824	spoolsv.exe	157
PID 3748 set thread context of 2648	3748	spoolsv.exe	159
PID 872 set thread context of 1900	872	spoolsv.exe	160
PID 2632 set thread context of 536	2632	spoolsv.exe	162
PID 4968 set thread context of 1292	4968	spoolsv.exe	164
PID 8 set thread context of 3628	8	spoolsv.exe	165
PID 1956 set thread context of 640	1956	spoolsv.exe	168
PID 4124 set thread context of 4404	4124	explorer.exe	171
PID 4824 set thread context of 1312	4824	spoolsv.exe	175
PID 4444 set thread context of 4820	4444	explorer.exe	177
PID 3352 set thread context of 3840	3352	spoolsv.exe	180
PID 5044 set thread context of 3000	5044	explorer.exe	182
PID 4008 set thread context of 3540	4008	spoolsv.exe	185
PID 4076 set thread context of 4456	4076	explorer.exe	187
PID 2232 set thread context of 2256	2232	spoolsv.exe	191
PID 2028 set thread context of 380	2028	explorer.exe	193
PID 4380 set thread context of 1660	4380	spoolsv.exe	196
PID 4560 set thread context of 3032	4560	explorer.exe	199
PID 1176 set thread context of 3288	1176	spoolsv.exe	201
PID 3616 set thread context of 2448	3616	explorer.exe	203
PID 4376 set thread context of 3284	4376	spoolsv.exe	204
PID 1688 set thread context of 3788	1688	explorer.exe	205
PID 4196 set thread context of 184	4196	spoolsv.exe	207
PID 852 set thread context of 3456	852	explorer.exe	209
PID 2964 set thread context of 3764	2964	spoolsv.exe	210
PID 4148 set thread context of 2300	4148	spoolsv.exe	212
PID 856 set thread context of 3452	856	spoolsv.exe	213
PID 3636 set thread context of 1596	3636	spoolsv.exe	216
PID 4400 set thread context of 4652	4400	explorer.exe	217

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4496	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
4496	explorer.exe
1744	spoolsv.exe
1744	spoolsv.exe
2652	spoolsv.exe
2652	spoolsv.exe
1808	spoolsv.exe
1808	spoolsv.exe
2712	spoolsv.exe
2712	spoolsv.exe
4696	spoolsv.exe
4696	spoolsv.exe
1800	spoolsv.exe
1800	spoolsv.exe
5040	spoolsv.exe
5040	spoolsv.exe
4672	spoolsv.exe
4672	spoolsv.exe
4768	spoolsv.exe
4768	spoolsv.exe
1992	spoolsv.exe
1992	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
1272	spoolsv.exe
1272	spoolsv.exe
1192	spoolsv.exe
1192	spoolsv.exe
1344	spoolsv.exe
1344	spoolsv.exe
60	spoolsv.exe
60	spoolsv.exe
1392	spoolsv.exe
1392	spoolsv.exe
1548	spoolsv.exe
1548	spoolsv.exe
3088	spoolsv.exe
3088	spoolsv.exe
1692	spoolsv.exe
1692	spoolsv.exe
3428	spoolsv.exe
3428	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
1436	spoolsv.exe
1436	spoolsv.exe
4760	spoolsv.exe
4760	spoolsv.exe
4280	spoolsv.exe
4280	spoolsv.exe
2648	spoolsv.exe
2648	spoolsv.exe
536	spoolsv.exe
536	spoolsv.exe
1292	spoolsv.exe
1292	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe
640	spoolsv.exe
640	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4764	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	81
PID 3808 wrote to memory of 4764	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	81
PID 3808 wrote to memory of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 3808 wrote to memory of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 3808 wrote to memory of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 3808 wrote to memory of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 3808 wrote to memory of 2508	3808	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	83
PID 2508 wrote to memory of 4004	2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	84
PID 2508 wrote to memory of 4004	2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	84
PID 2508 wrote to memory of 4004	2508	a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe	84
PID 4004 wrote to memory of 4496	4004	explorer.exe	92
PID 4004 wrote to memory of 4496	4004	explorer.exe	92
PID 4004 wrote to memory of 4496	4004	explorer.exe	92
PID 4004 wrote to memory of 4496	4004	explorer.exe	92
PID 4004 wrote to memory of 4496	4004	explorer.exe	92
PID 4496 wrote to memory of 3440	4496	explorer.exe	93
PID 4496 wrote to memory of 3440	4496	explorer.exe	93
PID 4496 wrote to memory of 3440	4496	explorer.exe	93
PID 4496 wrote to memory of 4720	4496	explorer.exe	94
PID 4496 wrote to memory of 4720	4496	explorer.exe	94
PID 4496 wrote to memory of 4720	4496	explorer.exe	94
PID 4496 wrote to memory of 1444	4496	explorer.exe	95
PID 4496 wrote to memory of 1444	4496	explorer.exe	95
PID 4496 wrote to memory of 1444	4496	explorer.exe	95
PID 4496 wrote to memory of 1844	4496	explorer.exe	96
PID 4496 wrote to memory of 1844	4496	explorer.exe	96
PID 4496 wrote to memory of 1844	4496	explorer.exe	96
PID 4496 wrote to memory of 1756	4496	explorer.exe	97
PID 4496 wrote to memory of 1756	4496	explorer.exe	97
PID 4496 wrote to memory of 1756	4496	explorer.exe	97
PID 4496 wrote to memory of 3104	4496	explorer.exe	98
PID 4496 wrote to memory of 3104	4496	explorer.exe	98
PID 4496 wrote to memory of 3104	4496	explorer.exe	98
PID 4496 wrote to memory of 2252	4496	explorer.exe	99
PID 4496 wrote to memory of 2252	4496	explorer.exe	99
PID 4496 wrote to memory of 2252	4496	explorer.exe	99
PID 4496 wrote to memory of 3968	4496	explorer.exe	100
PID 4496 wrote to memory of 3968	4496	explorer.exe	100
PID 4496 wrote to memory of 3968	4496	explorer.exe	100
PID 4496 wrote to memory of 3080	4496	explorer.exe	101
PID 4496 wrote to memory of 3080	4496	explorer.exe	101
PID 4496 wrote to memory of 3080	4496	explorer.exe	101
PID 4496 wrote to memory of 4312	4496	explorer.exe	102
PID 4496 wrote to memory of 4312	4496	explorer.exe	102
PID 4496 wrote to memory of 4312	4496	explorer.exe	102
PID 4496 wrote to memory of 4432	4496	explorer.exe	103
PID 4496 wrote to memory of 4432	4496	explorer.exe	103
PID 4496 wrote to memory of 4432	4496	explorer.exe	103
PID 4496 wrote to memory of 4972	4496	explorer.exe	104
PID 4496 wrote to memory of 4972	4496	explorer.exe	104
PID 4496 wrote to memory of 4972	4496	explorer.exe	104
PID 4496 wrote to memory of 4360	4496	explorer.exe	105
PID 4496 wrote to memory of 4360	4496	explorer.exe	105
PID 4496 wrote to memory of 4360	4496	explorer.exe	105
PID 4496 wrote to memory of 2812	4496	explorer.exe	106
PID 4496 wrote to memory of 2812	4496	explorer.exe	106
PID 4496 wrote to memory of 2812	4496	explorer.exe	106
PID 4496 wrote to memory of 1520	4496	explorer.exe	107
PID 4496 wrote to memory of 1520	4496	explorer.exe	107
PID 4496 wrote to memory of 1520	4496	explorer.exe	107
PID 4496 wrote to memory of 4172	4496	explorer.exe	108
PID 4496 wrote to memory of 4172	4496	explorer.exe	108
PID 4496 wrote to memory of 4172	4496	explorer.exe	108
PID 4496 wrote to memory of 3344	4496	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4764
- C:\Users\Admin\AppData\Local\Temp\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3dea5adac1ef67cefa452276ca887be_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4124
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4444
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4076
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3616
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:852
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3840
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:264
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2256
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1660
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 d3cede93e163b74102667bde8d6374444cd87cc9b9f553cf8c3810d693a904ac
MD5 0ffc1ae9fad97352dfb5f1a8a75d2d91
SHA1 45316d09a35ef9bc7eda28cec11b7487e2c61d23
SHA512 116ffac8e476f533ad14fb6725ee79a7759e63710be5332e9904bdce571e028489119a482a970905f5e315a8f35becad4b511f8212f8b1f75bfa450f497e9334
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZx:0UzeyQMS4DqodCnoe+iitjWwwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 08d3ed70c86cbb5f8d932fefe54f08d984eb7727c58d4186add599ff2c38ae23
MD5 ade7b25351438be7e803882464969124
SHA1 22199dd9988a08bb8547de7a596ae6f86e6c0f66
SHA512 d55009946349ee528536cc3085d87e9524679ebce45bfa705567a8bf2379d13f41d4b75c7fa9e4fa2a65c85a61c69a4c72bd59fb3d4abab2820f5aac78fbd4f7
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-2482-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/184-4741-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/208-1940-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/380-4237-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-3311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1192-2459-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1208-2944-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1232-5156-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-2579-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1312-3639-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1344-2470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1392-2565-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1444-952-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1444-2107-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-1801-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1548-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1548-2751-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-4957-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-4960-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1660-4391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1692-2617-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1744-2101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1744-1942-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1756-1114-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1800-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1808-2103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1844-1113-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1900-2957-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1900-3112-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1912-1938-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1992-2310-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2252-1286-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2256-4229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2300-4821-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-4588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-32-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-68-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2648-2902-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2652-1950-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/2652-1955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-2126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2812-1612-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3000-3820-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3032-4470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3080-1288-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3088-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-1115-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3284-4596-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3288-4576-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-1803-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3428-2670-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3440-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3440-820-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3452-4894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3456-4760-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-3946-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-4064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3139-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3764-4758-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3788-4608-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3808-28-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/3808-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3808-33-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3808-0-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/3840-3878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-3811-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3912-5067-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-1287-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4004-83-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4004-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4172-1802-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4280-2818-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-1471-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4360-1611-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4404-3406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4432-1472-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4456-3956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4496-85-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4496-819-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-5166-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-4969-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4656-2106-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4672-2225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-2135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4720-946-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4720-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4760-2812-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4768-2298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4768-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-3650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-1954-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4972-1610-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5020-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5040-2153-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-2157-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-2319-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-2323-0x0000000000400000-0x000000000043E000-memory.dmp

Download