pony | d54ece8d373c4ed6dc3e7eac738cdf0f8b9f269a333aea22a9641693739d69ca

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 05:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
Size 2.2MB
Sample240613-fp8paavfmc
SHA256 d54ece8d373c4ed6dc3e7eac738cdf0f8b9f269a333aea22a9641693739d69ca
MD5 a3e932df387e80efacd19c60b3adc241
SHA1 d7e95aca840bac4dd87a61d7e65f8c6f061df7ae
SHA512 46e18841b1dceffca975cb18ca64c19817e13744bb5f222412f6826e4460a558c03688cf84defb3692054f9376fa792c86a985ae7ab264a08843d1029f27f417
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZP:0UzeyQMS4DqodCnoe+iitjWwwj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2988	explorer.exe
224	explorer.exe
4168	spoolsv.exe
4444	spoolsv.exe
1324	spoolsv.exe
208	spoolsv.exe
4048	spoolsv.exe
5012	spoolsv.exe
1992	spoolsv.exe
4784	spoolsv.exe
3140	spoolsv.exe
2700	spoolsv.exe
4172	spoolsv.exe
1256	spoolsv.exe
3832	spoolsv.exe
4360	spoolsv.exe
2664	spoolsv.exe
3440	spoolsv.exe
4424	spoolsv.exe
4492	spoolsv.exe
1412	spoolsv.exe
3504	spoolsv.exe
2172	spoolsv.exe
1288	spoolsv.exe
1512	spoolsv.exe
396	spoolsv.exe
3148	spoolsv.exe
2056	spoolsv.exe
3972	spoolsv.exe
1696	spoolsv.exe
4908	spoolsv.exe
3396	spoolsv.exe
1636	spoolsv.exe
1212	spoolsv.exe
4104	spoolsv.exe
3564	spoolsv.exe
2008	explorer.exe
4936	spoolsv.exe
2424	spoolsv.exe
3704	spoolsv.exe
432	spoolsv.exe
1984	spoolsv.exe
4612	spoolsv.exe
3216	spoolsv.exe
3904	spoolsv.exe
768	spoolsv.exe
2032	explorer.exe
2512	spoolsv.exe
4636	spoolsv.exe
1564	spoolsv.exe
3672	spoolsv.exe
4500	spoolsv.exe
4440	explorer.exe
1784	spoolsv.exe
2388	spoolsv.exe
3940	spoolsv.exe
2344	spoolsv.exe
640	spoolsv.exe
3812	spoolsv.exe
4684	spoolsv.exe
3136	explorer.exe
3716	spoolsv.exe
1952	spoolsv.exe
3996	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 49 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 2988 set thread context of 224	2988	explorer.exe	93
PID 4168 set thread context of 3564	4168	spoolsv.exe	127
PID 4444 set thread context of 4936	4444	spoolsv.exe	129
PID 1324 set thread context of 3704	1324	spoolsv.exe	131
PID 208 set thread context of 432	208	spoolsv.exe	132
PID 4048 set thread context of 1984	4048	spoolsv.exe	133
PID 5012 set thread context of 4612	5012	spoolsv.exe	134
PID 1992 set thread context of 3216	1992	spoolsv.exe	135
PID 4784 set thread context of 3904	4784	spoolsv.exe	136
PID 3140 set thread context of 2512	3140	spoolsv.exe	139
PID 2700 set thread context of 4636	2700	spoolsv.exe	140
PID 4172 set thread context of 1564	4172	spoolsv.exe	142
PID 1256 set thread context of 4500	1256	spoolsv.exe	144
PID 3832 set thread context of 1784	3832	spoolsv.exe	146
PID 4360 set thread context of 2388	4360	spoolsv.exe	147
PID 2664 set thread context of 3940	2664	spoolsv.exe	148
PID 3440 set thread context of 2344	3440	spoolsv.exe	149
PID 4424 set thread context of 640	4424	spoolsv.exe	150
PID 4492 set thread context of 4684	4492	spoolsv.exe	152
PID 1412 set thread context of 3716	1412	spoolsv.exe	154
PID 3504 set thread context of 1952	3504	spoolsv.exe	155
PID 2172 set thread context of 3996	2172	spoolsv.exe	156
PID 1288 set thread context of 3628	1288	spoolsv.exe	157
PID 1512 set thread context of 1628	1512	spoolsv.exe	159
PID 396 set thread context of 2204	396	spoolsv.exe	160
PID 3148 set thread context of 4032	3148	spoolsv.exe	162
PID 2056 set thread context of 3128	2056	spoolsv.exe	163
PID 3972 set thread context of 4992	3972	spoolsv.exe	164
PID 1696 set thread context of 1668	1696	spoolsv.exe	165
PID 4908 set thread context of 3052	4908	spoolsv.exe	166
PID 3396 set thread context of 4460	3396	spoolsv.exe	168
PID 1636 set thread context of 4844	1636	spoolsv.exe	169
PID 1212 set thread context of 4328	1212	spoolsv.exe	171
PID 4104 set thread context of 3784	4104	spoolsv.exe	176
PID 2008 set thread context of 4932	2008	explorer.exe	181
PID 2424 set thread context of 640	2424	spoolsv.exe	183
PID 768 set thread context of 2548	768	spoolsv.exe	187
PID 2032 set thread context of 4712	2032	explorer.exe	189
PID 3672 set thread context of 2580	3672	spoolsv.exe	192
PID 4440 set thread context of 1508	4440	explorer.exe	194
PID 3812 set thread context of 4320	3812	spoolsv.exe	198
PID 3136 set thread context of 3544	3136	explorer.exe	201
PID 3640 set thread context of 1140	3640	spoolsv.exe	205
PID 1960 set thread context of 2156	1960	explorer.exe	208
PID 3348 set thread context of 4312	3348	explorer.exe	209
PID 4700 set thread context of 1044	4700	spoolsv.exe	210
PID 4180 set thread context of 3568	4180	spoolsv.exe	212
PID 1624 set thread context of 2060	1624	spoolsv.exe	214

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
3564	spoolsv.exe
3564	spoolsv.exe
4936	spoolsv.exe
4936	spoolsv.exe
3704	spoolsv.exe
3704	spoolsv.exe
432	spoolsv.exe
432	spoolsv.exe
1984	spoolsv.exe
1984	spoolsv.exe
4612	spoolsv.exe
4612	spoolsv.exe
3216	spoolsv.exe
3216	spoolsv.exe
3904	spoolsv.exe
3904	spoolsv.exe
2512	spoolsv.exe
2512	spoolsv.exe
4636	spoolsv.exe
4636	spoolsv.exe
1564	spoolsv.exe
1564	spoolsv.exe
4500	spoolsv.exe
4500	spoolsv.exe
1784	spoolsv.exe
1784	spoolsv.exe
2388	spoolsv.exe
2388	spoolsv.exe
3940	spoolsv.exe
3940	spoolsv.exe
2344	spoolsv.exe
2344	spoolsv.exe
640	spoolsv.exe
640	spoolsv.exe
4684	spoolsv.exe
4684	spoolsv.exe
3716	spoolsv.exe
3716	spoolsv.exe
1952	spoolsv.exe
1952	spoolsv.exe
3996	spoolsv.exe
3996	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe
1628	spoolsv.exe
1628	spoolsv.exe
2204	spoolsv.exe
2204	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
4992	spoolsv.exe
4992	spoolsv.exe
1668	spoolsv.exe
1668	spoolsv.exe
3052	spoolsv.exe
3052	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 684	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	82
PID 1144 wrote to memory of 684	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	82
PID 1144 wrote to memory of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 1144 wrote to memory of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 1144 wrote to memory of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 1144 wrote to memory of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 1144 wrote to memory of 4796	1144	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	88
PID 4796 wrote to memory of 2988	4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	89
PID 4796 wrote to memory of 2988	4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	89
PID 4796 wrote to memory of 2988	4796	a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe	89
PID 2988 wrote to memory of 224	2988	explorer.exe	93
PID 2988 wrote to memory of 224	2988	explorer.exe	93
PID 2988 wrote to memory of 224	2988	explorer.exe	93
PID 2988 wrote to memory of 224	2988	explorer.exe	93
PID 2988 wrote to memory of 224	2988	explorer.exe	93
PID 224 wrote to memory of 4168	224	explorer.exe	94
PID 224 wrote to memory of 4168	224	explorer.exe	94
PID 224 wrote to memory of 4168	224	explorer.exe	94
PID 224 wrote to memory of 4444	224	explorer.exe	95
PID 224 wrote to memory of 4444	224	explorer.exe	95
PID 224 wrote to memory of 4444	224	explorer.exe	95
PID 224 wrote to memory of 1324	224	explorer.exe	96
PID 224 wrote to memory of 1324	224	explorer.exe	96
PID 224 wrote to memory of 1324	224	explorer.exe	96
PID 224 wrote to memory of 208	224	explorer.exe	97
PID 224 wrote to memory of 208	224	explorer.exe	97
PID 224 wrote to memory of 208	224	explorer.exe	97
PID 224 wrote to memory of 4048	224	explorer.exe	98
PID 224 wrote to memory of 4048	224	explorer.exe	98
PID 224 wrote to memory of 4048	224	explorer.exe	98
PID 224 wrote to memory of 5012	224	explorer.exe	99
PID 224 wrote to memory of 5012	224	explorer.exe	99
PID 224 wrote to memory of 5012	224	explorer.exe	99
PID 224 wrote to memory of 1992	224	explorer.exe	100
PID 224 wrote to memory of 1992	224	explorer.exe	100
PID 224 wrote to memory of 1992	224	explorer.exe	100
PID 224 wrote to memory of 4784	224	explorer.exe	101
PID 224 wrote to memory of 4784	224	explorer.exe	101
PID 224 wrote to memory of 4784	224	explorer.exe	101
PID 224 wrote to memory of 3140	224	explorer.exe	102
PID 224 wrote to memory of 3140	224	explorer.exe	102
PID 224 wrote to memory of 3140	224	explorer.exe	102
PID 224 wrote to memory of 2700	224	explorer.exe	103
PID 224 wrote to memory of 2700	224	explorer.exe	103
PID 224 wrote to memory of 2700	224	explorer.exe	103
PID 224 wrote to memory of 4172	224	explorer.exe	104
PID 224 wrote to memory of 4172	224	explorer.exe	104
PID 224 wrote to memory of 4172	224	explorer.exe	104
PID 224 wrote to memory of 1256	224	explorer.exe	105
PID 224 wrote to memory of 1256	224	explorer.exe	105
PID 224 wrote to memory of 1256	224	explorer.exe	105
PID 224 wrote to memory of 3832	224	explorer.exe	106
PID 224 wrote to memory of 3832	224	explorer.exe	106
PID 224 wrote to memory of 3832	224	explorer.exe	106
PID 224 wrote to memory of 4360	224	explorer.exe	107
PID 224 wrote to memory of 4360	224	explorer.exe	107
PID 224 wrote to memory of 4360	224	explorer.exe	107
PID 224 wrote to memory of 2664	224	explorer.exe	108
PID 224 wrote to memory of 2664	224	explorer.exe	108
PID 224 wrote to memory of 2664	224	explorer.exe	108
PID 224 wrote to memory of 3440	224	explorer.exe	109
PID 224 wrote to memory of 3440	224	explorer.exe	109
PID 224 wrote to memory of 3440	224	explorer.exe	109
PID 224 wrote to memory of 4424	224	explorer.exe	110

C:\Users\Admin\AppData\Local\Temp\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:684
- C:\Users\Admin\AppData\Local\Temp\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3e932df387e80efacd19c60b3adc241_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2008
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2032
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4440
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3136
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3784
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2144
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2976
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4404
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4320
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 8483da01423bf314788988757d05ae2bc5976a62b2059b96f1de9f0d1c265445
MD5 f8d0603204057bc61eb359b42802f05e
SHA1 8ba02eae5a646439180b278cbe3a5a9e2a7b31b7
SHA512 fd2d51740732eb4cee90c93ca483bf447635ce16b17eaf8fcdd8729f0fa3c01919302bd815e83a226539a7068ea6a910ae7821be7a21f6b664a0646ea4133712
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZP:0UzeyQMS4DqodCnoe+iitjWwwj
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 63ee31e785e67d628e8161d77773c5b5d01b91daeeb6cbf9fe62d929a4c3f79a
MD5 18bb5efd03854d0b0da018210014004b
SHA1 4eff724449be98b1a2255ecddd45b7ae16b1714d
SHA512 4e6b16eac3986a69a64768a6dcfd556a34a70637e08ed1f84c73f449e5847c3290340eddfe7aa99309fac3d2d2643ea8f601c67073288216e28717d4ba0ce5e0
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ2:0UzeyQMS4DqodCnoe+iitjWwwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-1150-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/224-956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/396-2393-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/432-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-2839-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-2835-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-4051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/640-4165-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/864-5566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1140-4969-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1144-43-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/1144-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1144-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1144-0-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/1256-1743-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1288-2291-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1324-2397-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1324-1149-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1412-2196-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1508-4448-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1512-2301-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1564-2618-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-3114-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1668-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1784-2799-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1952-2996-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1952-2992-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1984-2419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1992-1351-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2060-5233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2152-5245-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2156-5071-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2172-2290-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2204-3208-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2204-3386-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2344-2827-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2512-2597-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-4266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-4327-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-4439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-4555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2700-1544-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2988-102-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2988-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3052-3269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3140-1543-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3440-1990-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3504-2289-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3544-4755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-2498-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-2292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3025-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3652-5272-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3652-5277-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3704-2400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3716-2983-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-3812-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3832-1744-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3904-2753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3904-2578-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3940-2816-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-3007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4048-1349-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4168-957-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4168-2293-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4172-1742-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4312-5147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4320-4673-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-3413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4424-2194-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-2298-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-1148-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4460-3353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-5607-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-2195-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4500-2783-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-2942-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4612-2428-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-5396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-2606-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4684-2975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4684-3189-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-4275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4784-1542-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4796-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-47-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-85-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-83-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4844-3475-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-3403-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-5377-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4936-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4948-5266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-5662-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4992-3235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-1350-0x0000000000400000-0x00000000005D3000-memory.dmp

Download