pony | f4e9f003363868e8f36b6f360dc5f41fb23c1bfaa402f6426c3ad510290985f8

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
Size 2.2MB
Sample240613-g515ta1err
SHA256 f4e9f003363868e8f36b6f360dc5f41fb23c1bfaa402f6426c3ad510290985f8
MD5 a42f8a2aa101851b8ea30f6b9a3f3996
SHA1 d59d87e20afc4df23a573c2bc14c3aaeb62f23be
SHA512 bf11ee12fbd15fc2ae0d25cbbecee542bcc6ca8512980799e92f62ac0b01268ef073fce522680bc73e9da4597e6b836da5e3082be85b73fc1fb222327c1bb659
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2496	explorer.exe
4312	explorer.exe
4044	spoolsv.exe
1732	spoolsv.exe
2692	spoolsv.exe
5088	spoolsv.exe
584	spoolsv.exe
4552	spoolsv.exe
2904	spoolsv.exe
992	spoolsv.exe
2324	spoolsv.exe
3696	spoolsv.exe
5100	spoolsv.exe
376	spoolsv.exe
1620	spoolsv.exe
1676	spoolsv.exe
3652	spoolsv.exe
4340	spoolsv.exe
2040	spoolsv.exe
2396	spoolsv.exe
1544	spoolsv.exe
3792	spoolsv.exe
4036	spoolsv.exe
2184	spoolsv.exe
828	spoolsv.exe
868	spoolsv.exe
2332	spoolsv.exe
4368	spoolsv.exe
4932	spoolsv.exe
3708	spoolsv.exe
4128	spoolsv.exe
2212	spoolsv.exe
3592	spoolsv.exe
2872	explorer.exe
4752	spoolsv.exe
2900	spoolsv.exe
4980	spoolsv.exe
1892	spoolsv.exe
1940	explorer.exe
2216	spoolsv.exe
3276	spoolsv.exe
4280	spoolsv.exe
4712	spoolsv.exe
4720	spoolsv.exe
4872	spoolsv.exe
1776	explorer.exe
3932	spoolsv.exe
1352	spoolsv.exe
4120	spoolsv.exe
3184	spoolsv.exe
2292	spoolsv.exe
5072	explorer.exe
2824	spoolsv.exe
3052	spoolsv.exe
3844	spoolsv.exe
1612	spoolsv.exe
2132	spoolsv.exe
2012	explorer.exe
2480	spoolsv.exe
3316	spoolsv.exe
1972	spoolsv.exe
2532	spoolsv.exe
5056	explorer.exe
3056	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 2496 set thread context of 4312	2496	explorer.exe	96
PID 4044 set thread context of 3592	4044	spoolsv.exe	127
PID 1732 set thread context of 4752	1732	spoolsv.exe	129
PID 2692 set thread context of 2900	2692	spoolsv.exe	130
PID 5088 set thread context of 1892	5088	spoolsv.exe	132
PID 584 set thread context of 2216	584	spoolsv.exe	134
PID 4552 set thread context of 3276	4552	spoolsv.exe	135
PID 2904 set thread context of 4280	2904	spoolsv.exe	136
PID 992 set thread context of 4720	992	spoolsv.exe	138
PID 2324 set thread context of 4872	2324	spoolsv.exe	139
PID 3696 set thread context of 3932	3696	spoolsv.exe	141
PID 5100 set thread context of 1352	5100	spoolsv.exe	142
PID 376 set thread context of 3184	376	spoolsv.exe	144
PID 1620 set thread context of 2292	1620	spoolsv.exe	145
PID 1676 set thread context of 2824	1676	spoolsv.exe	147
PID 3652 set thread context of 3052	3652	spoolsv.exe	148
PID 4340 set thread context of 1612	4340	spoolsv.exe	150
PID 2040 set thread context of 2132	2040	spoolsv.exe	151
PID 2396 set thread context of 2480	2396	spoolsv.exe	153
PID 1544 set thread context of 3316	1544	spoolsv.exe	154
PID 3792 set thread context of 2532	3792	spoolsv.exe	156
PID 4036 set thread context of 3056	4036	spoolsv.exe	158
PID 2184 set thread context of 4364	2184	spoolsv.exe	159
PID 828 set thread context of 408	828	spoolsv.exe	160
PID 868 set thread context of 4308	868	spoolsv.exe	162
PID 2332 set thread context of 1640	2332	spoolsv.exe	164
PID 4368 set thread context of 404	4368	spoolsv.exe	165
PID 4932 set thread context of 3648	4932	spoolsv.exe	166
PID 3708 set thread context of 3884	3708	spoolsv.exe	167
PID 4128 set thread context of 4724	4128	spoolsv.exe	169
PID 2212 set thread context of 5068	2212	spoolsv.exe	172
PID 2872 set thread context of 4252	2872	explorer.exe	174
PID 4980 set thread context of 1656	4980	spoolsv.exe	179
PID 1940 set thread context of 4784	1940	explorer.exe	181
PID 4712 set thread context of 964	4712	spoolsv.exe	184
PID 1776 set thread context of 4832	1776	explorer.exe	186
PID 4120 set thread context of 2364	4120	spoolsv.exe	189
PID 5072 set thread context of 3352	5072	explorer.exe	191
PID 3844 set thread context of 3680	3844	spoolsv.exe	193
PID 2012 set thread context of 4696	2012	explorer.exe	195
PID 1972 set thread context of 4452	1972	spoolsv.exe	199
PID 5056 set thread context of 4708	5056	explorer.exe	201
PID 2584 set thread context of 680	2584	spoolsv.exe	205
PID 4944 set thread context of 3628	4944	explorer.exe	207
PID 2312 set thread context of 2008	2312	spoolsv.exe	208
PID 1792 set thread context of 2196	1792	explorer.exe	209
PID 3192 set thread context of 4564	3192	spoolsv.exe	211
PID 1920 set thread context of 4764	1920	spoolsv.exe	214
PID 4532 set thread context of 1888	4532	explorer.exe	215
PID 1316 set thread context of 1228	1316	spoolsv.exe	216
PID 4344 set thread context of 2844	4344	spoolsv.exe	217
PID 3508 set thread context of 4824	3508	explorer.exe	219
PID 5112 set thread context of 4812	5112	spoolsv.exe	220

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4312	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
4312	explorer.exe
3592	spoolsv.exe
3592	spoolsv.exe
4752	spoolsv.exe
4752	spoolsv.exe
2900	spoolsv.exe
2900	spoolsv.exe
1892	spoolsv.exe
1892	spoolsv.exe
2216	spoolsv.exe
2216	spoolsv.exe
3276	spoolsv.exe
3276	spoolsv.exe
4280	spoolsv.exe
4280	spoolsv.exe
4720	spoolsv.exe
4720	spoolsv.exe
4872	spoolsv.exe
4872	spoolsv.exe
3932	spoolsv.exe
3932	spoolsv.exe
1352	spoolsv.exe
1352	spoolsv.exe
3184	spoolsv.exe
3184	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
2824	spoolsv.exe
2824	spoolsv.exe
3052	spoolsv.exe
3052	spoolsv.exe
1612	spoolsv.exe
1612	spoolsv.exe
2132	spoolsv.exe
2132	spoolsv.exe
2480	spoolsv.exe
2480	spoolsv.exe
3316	spoolsv.exe
3316	spoolsv.exe
2532	spoolsv.exe
2532	spoolsv.exe
3056	spoolsv.exe
3056	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe
408	spoolsv.exe
408	spoolsv.exe
4308	spoolsv.exe
4308	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
404	spoolsv.exe
404	spoolsv.exe
3648	spoolsv.exe
3648	spoolsv.exe
3884	spoolsv.exe
3884	spoolsv.exe
4724	spoolsv.exe
4724	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 816	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	82
PID 408 wrote to memory of 816	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	82
PID 408 wrote to memory of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 408 wrote to memory of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 408 wrote to memory of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 408 wrote to memory of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 408 wrote to memory of 460	408	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	87
PID 460 wrote to memory of 2496	460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	88
PID 460 wrote to memory of 2496	460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	88
PID 460 wrote to memory of 2496	460	a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe	88
PID 2496 wrote to memory of 4312	2496	explorer.exe	96
PID 2496 wrote to memory of 4312	2496	explorer.exe	96
PID 2496 wrote to memory of 4312	2496	explorer.exe	96
PID 2496 wrote to memory of 4312	2496	explorer.exe	96
PID 2496 wrote to memory of 4312	2496	explorer.exe	96
PID 4312 wrote to memory of 4044	4312	explorer.exe	97
PID 4312 wrote to memory of 4044	4312	explorer.exe	97
PID 4312 wrote to memory of 4044	4312	explorer.exe	97
PID 4312 wrote to memory of 1732	4312	explorer.exe	98
PID 4312 wrote to memory of 1732	4312	explorer.exe	98
PID 4312 wrote to memory of 1732	4312	explorer.exe	98
PID 4312 wrote to memory of 2692	4312	explorer.exe	99
PID 4312 wrote to memory of 2692	4312	explorer.exe	99
PID 4312 wrote to memory of 2692	4312	explorer.exe	99
PID 4312 wrote to memory of 5088	4312	explorer.exe	100
PID 4312 wrote to memory of 5088	4312	explorer.exe	100
PID 4312 wrote to memory of 5088	4312	explorer.exe	100
PID 4312 wrote to memory of 584	4312	explorer.exe	101
PID 4312 wrote to memory of 584	4312	explorer.exe	101
PID 4312 wrote to memory of 584	4312	explorer.exe	101
PID 4312 wrote to memory of 4552	4312	explorer.exe	102
PID 4312 wrote to memory of 4552	4312	explorer.exe	102
PID 4312 wrote to memory of 4552	4312	explorer.exe	102
PID 4312 wrote to memory of 2904	4312	explorer.exe	103
PID 4312 wrote to memory of 2904	4312	explorer.exe	103
PID 4312 wrote to memory of 2904	4312	explorer.exe	103
PID 4312 wrote to memory of 992	4312	explorer.exe	104
PID 4312 wrote to memory of 992	4312	explorer.exe	104
PID 4312 wrote to memory of 992	4312	explorer.exe	104
PID 4312 wrote to memory of 2324	4312	explorer.exe	105
PID 4312 wrote to memory of 2324	4312	explorer.exe	105
PID 4312 wrote to memory of 2324	4312	explorer.exe	105
PID 4312 wrote to memory of 3696	4312	explorer.exe	106
PID 4312 wrote to memory of 3696	4312	explorer.exe	106
PID 4312 wrote to memory of 3696	4312	explorer.exe	106
PID 4312 wrote to memory of 5100	4312	explorer.exe	107
PID 4312 wrote to memory of 5100	4312	explorer.exe	107
PID 4312 wrote to memory of 5100	4312	explorer.exe	107
PID 4312 wrote to memory of 376	4312	explorer.exe	108
PID 4312 wrote to memory of 376	4312	explorer.exe	108
PID 4312 wrote to memory of 376	4312	explorer.exe	108
PID 4312 wrote to memory of 1620	4312	explorer.exe	109
PID 4312 wrote to memory of 1620	4312	explorer.exe	109
PID 4312 wrote to memory of 1620	4312	explorer.exe	109
PID 4312 wrote to memory of 1676	4312	explorer.exe	110
PID 4312 wrote to memory of 1676	4312	explorer.exe	110
PID 4312 wrote to memory of 1676	4312	explorer.exe	110
PID 4312 wrote to memory of 3652	4312	explorer.exe	111
PID 4312 wrote to memory of 3652	4312	explorer.exe	111
PID 4312 wrote to memory of 3652	4312	explorer.exe	111
PID 4312 wrote to memory of 4340	4312	explorer.exe	112
PID 4312 wrote to memory of 4340	4312	explorer.exe	112
PID 4312 wrote to memory of 4340	4312	explorer.exe	112
PID 4312 wrote to memory of 2040	4312	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:816
- C:\Users\Admin\AppData\Local\Temp\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a42f8a2aa101851b8ea30f6b9a3f3996_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:460
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2872
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1776
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5056
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4944
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5068
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1656
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3508
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:964
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:64
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 995822c731e8e7ebbef8b14d0d7ab045faeedc98633cb7cacd5ff43adadb49c0
MD5 2f2c6bf4ed67d43e0fee1a97f367f8b3
SHA1 00cad4240b8f5a848225d09750b32c65bd6c0fe0
SHA512 89f9df6a6929abcc367de22fb0f827a3ad92623cbad33a47bad05ad324f9443a0623202fbee2a73d704092e8a663f45bf2bd2ed8b342f126dc2a1c934d1c75f3
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWwwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 0cf1b3a18c2ea3e2d98bf1c38a32a6c3c18a934c69096bf2af1b6e79b8f47827
MD5 bc50ff83ea54c454eaf40ea54fe96fb1
SHA1 ace2618f48e0d18d6e1fd87ad07e1a5ae025f47d
SHA512 ce516a50da221ce8b3a320d89dd05307c38a313496fbf99a3aa0c15b747559e1f35e25de946cafa8eb49dff17288c7246ec7fea6bc3785145efbacee38dec666
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWww9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-1494-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/408-38-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/408-2836-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/408-33-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/408-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/460-37-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/460-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/460-78-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/460-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/584-1135-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/680-4457-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/680-4623-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/964-3723-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/992-1308-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1352-2338-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1544-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1612-2574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-1642-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1640-2980-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1640-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-3553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-3622-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-1643-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1732-1962-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1732-977-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1780-5101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1888-4754-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1892-2296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1892-2125-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-4475-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2040-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2076-5017-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2076-5148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2132-2778-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2132-2670-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2184-1986-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2196-4486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2216-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2292-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-1309-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2364-3888-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2396-1952-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2480-2676-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2496-86-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2496-92-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2532-2809-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2692-2009-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2692-978-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2808-5091-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2824-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2844-4773-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2900-1987-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2904-1307-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3052-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3276-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-2688-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3352-3899-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3592-2107-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3592-1954-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-4467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-2999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3652-1832-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3680-3977-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3680-4098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3696-1492-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3792-1964-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3884-3012-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3932-2328-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4036-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4044-812-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4044-1955-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4252-3343-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4280-2156-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-3130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2963-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-811-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-91-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-1833-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4364-2824-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4552-1136-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4564-4861-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-4643-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-3986-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-4224-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4724-3259-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4752-1966-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4764-4743-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4784-3561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4784-3564-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-4997-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4824-4873-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4832-3735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4832-3733-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-3411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5088-979-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5100-1493-0x0000000000400000-0x00000000005D3000-memory.dmp

Download