pony | af7bb9d6c0b236b8060d6bde10e7da34a9e563ca45f86c27f11098540d596a5f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
Size 2.2MB
Sample240613-hfsb2ssarj
SHA256 af7bb9d6c0b236b8060d6bde10e7da34a9e563ca45f86c27f11098540d596a5f
MD5 a440740b9893b2ecd76d0451d91f96af
SHA1 d1e3ff0f6d01ec8337e7a30be6bf5e65e6bee7e7
SHA512 f91ad2f94914ce82ff4ea40a92f27744152854f72093f8f34d30b963466b0f321451dff46fabe981b3bc6a3499103623da0d98eb7d39317c4e58362b226a744f
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZO:0UzeyQMS4DqodCnoe+iitjWwwy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1800	explorer.exe
1632	explorer.exe
4804	spoolsv.exe
3720	spoolsv.exe
1808	spoolsv.exe
3012	spoolsv.exe
4612	spoolsv.exe
3920	spoolsv.exe
3984	spoolsv.exe
2416	spoolsv.exe
4436	spoolsv.exe
2144	spoolsv.exe
1676	spoolsv.exe
2356	spoolsv.exe
1820	spoolsv.exe
1376	spoolsv.exe
4800	spoolsv.exe
2132	spoolsv.exe
4688	spoolsv.exe
676	spoolsv.exe
1392	spoolsv.exe
1184	spoolsv.exe
840	spoolsv.exe
1456	spoolsv.exe
2500	spoolsv.exe
4504	spoolsv.exe
4868	spoolsv.exe
2560	spoolsv.exe
4976	spoolsv.exe
3700	spoolsv.exe
732	spoolsv.exe
5344	spoolsv.exe
5416	spoolsv.exe
5456	explorer.exe
5524	spoolsv.exe
5608	spoolsv.exe
5888	spoolsv.exe
5952	spoolsv.exe
6012	spoolsv.exe
6088	spoolsv.exe
5184	spoolsv.exe
3128	spoolsv.exe
5576	explorer.exe
2620	spoolsv.exe
5924	spoolsv.exe
5964	spoolsv.exe
3036	spoolsv.exe
5168	spoolsv.exe
5312	explorer.exe
5272	spoolsv.exe
5300	spoolsv.exe
5616	spoolsv.exe
5716	spoolsv.exe
5824	spoolsv.exe
3064	spoolsv.exe
6100	explorer.exe
5260	spoolsv.exe
5432	spoolsv.exe
4424	spoolsv.exe
1180	spoolsv.exe
5592	spoolsv.exe
4864	spoolsv.exe
5268	explorer.exe
5124	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 1800 set thread context of 1632	1800	explorer.exe	105
PID 4804 set thread context of 5416	4804	spoolsv.exe	136
PID 3720 set thread context of 5524	3720	spoolsv.exe	138
PID 1808 set thread context of 5608	1808	spoolsv.exe	139
PID 3012 set thread context of 5952	3012	spoolsv.exe	141
PID 4612 set thread context of 6012	4612	spoolsv.exe	142
PID 3920 set thread context of 6088	3920	spoolsv.exe	143
PID 3984 set thread context of 5184	3984	spoolsv.exe	144
PID 2416 set thread context of 3128	2416	spoolsv.exe	145
PID 4436 set thread context of 2620	4436	spoolsv.exe	147
PID 2144 set thread context of 5964	2144	spoolsv.exe	149
PID 1676 set thread context of 3036	1676	spoolsv.exe	150
PID 2356 set thread context of 5168	2356	spoolsv.exe	151
PID 1820 set thread context of 5272	1820	spoolsv.exe	153
PID 1376 set thread context of 5300	1376	spoolsv.exe	154
PID 4800 set thread context of 5716	4800	spoolsv.exe	156
PID 2132 set thread context of 5824	2132	spoolsv.exe	157
PID 4688 set thread context of 3064	4688	spoolsv.exe	158
PID 676 set thread context of 5432	676	spoolsv.exe	161
PID 1392 set thread context of 4424	1392	spoolsv.exe	162
PID 1184 set thread context of 1180	1184	spoolsv.exe	163
PID 840 set thread context of 5592	840	spoolsv.exe	164
PID 1456 set thread context of 4864	1456	spoolsv.exe	165
PID 2500 set thread context of 2116	2500	spoolsv.exe	168
PID 4504 set thread context of 3684	4504	spoolsv.exe	169
PID 4868 set thread context of 5408	4868	spoolsv.exe	170
PID 2560 set thread context of 4112	2560	spoolsv.exe	172
PID 4976 set thread context of 1328	4976	spoolsv.exe	174
PID 3700 set thread context of 2016	3700	spoolsv.exe	175
PID 732 set thread context of 5572	732	spoolsv.exe	177
PID 5344 set thread context of 4448	5344	spoolsv.exe	182
PID 5456 set thread context of 5620	5456	explorer.exe	186
PID 5888 set thread context of 5728	5888	spoolsv.exe	188
PID 5576 set thread context of 5136	5576	explorer.exe	192
PID 5924 set thread context of 4480	5924	spoolsv.exe	194
PID 5312 set thread context of 5372	5312	explorer.exe	198
PID 5616 set thread context of 5912	5616	spoolsv.exe	200
PID 6100 set thread context of 6040	6100	explorer.exe	204
PID 5260 set thread context of 1800	5260	spoolsv.exe	206
PID 5268 set thread context of 1644	5268	explorer.exe	210
PID 5124 set thread context of 1204	5124	spoolsv.exe	211
PID 4224 set thread context of 2400	4224	explorer.exe	215
PID 5872 set thread context of 2632	5872	spoolsv.exe	216
PID 3400 set thread context of 2028	3400	spoolsv.exe	218
PID 2224 set thread context of 1892	2224	explorer.exe	219
PID 2680 set thread context of 5180	2680	spoolsv.exe	220
PID 2004 set thread context of 5176	2004	spoolsv.exe	221
PID 2724 set thread context of 5564	2724	spoolsv.exe	222
PID 5476 set thread context of 1452	5476	explorer.exe	223
PID 5708 set thread context of 6132	5708	spoolsv.exe	225
PID 1584 set thread context of 5176	1584	spoolsv.exe	227
PID 5216 set thread context of 5144	5216	spoolsv.exe	230
PID 5228 set thread context of 4856	5228	spoolsv.exe	232
PID 920 set thread context of 4248	920	explorer.exe	233
PID 4672 set thread context of 632	4672	spoolsv.exe	235

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1632	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
1632	explorer.exe
5416	spoolsv.exe
5416	spoolsv.exe
5524	spoolsv.exe
5524	spoolsv.exe
5608	spoolsv.exe
5608	spoolsv.exe
5952	spoolsv.exe
5952	spoolsv.exe
6012	spoolsv.exe
6012	spoolsv.exe
6088	spoolsv.exe
6088	spoolsv.exe
5184	spoolsv.exe
5184	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
2620	spoolsv.exe
2620	spoolsv.exe
5964	spoolsv.exe
5964	spoolsv.exe
3036	spoolsv.exe
3036	spoolsv.exe
5168	spoolsv.exe
5168	spoolsv.exe
5272	spoolsv.exe
5272	spoolsv.exe
5300	spoolsv.exe
5300	spoolsv.exe
5716	spoolsv.exe
5716	spoolsv.exe
5824	spoolsv.exe
5824	spoolsv.exe
3064	spoolsv.exe
3064	spoolsv.exe
5432	spoolsv.exe
5432	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
1180	spoolsv.exe
1180	spoolsv.exe
5592	spoolsv.exe
5592	spoolsv.exe
4864	spoolsv.exe
4864	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
3684	spoolsv.exe
3684	spoolsv.exe
5408	spoolsv.exe
5408	spoolsv.exe
4112	spoolsv.exe
4112	spoolsv.exe
1328	spoolsv.exe
1328	spoolsv.exe
2016	spoolsv.exe
2016	spoolsv.exe
5572	spoolsv.exe
5572	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3864	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	89
PID 4496 wrote to memory of 3864	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	89
PID 4496 wrote to memory of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3736	4496	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	96
PID 3736 wrote to memory of 1800	3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	97
PID 3736 wrote to memory of 1800	3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	97
PID 3736 wrote to memory of 1800	3736	a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe	97
PID 1800 wrote to memory of 1632	1800	explorer.exe	105
PID 1800 wrote to memory of 1632	1800	explorer.exe	105
PID 1800 wrote to memory of 1632	1800	explorer.exe	105
PID 1800 wrote to memory of 1632	1800	explorer.exe	105
PID 1800 wrote to memory of 1632	1800	explorer.exe	105
PID 1632 wrote to memory of 4804	1632	explorer.exe	106
PID 1632 wrote to memory of 4804	1632	explorer.exe	106
PID 1632 wrote to memory of 4804	1632	explorer.exe	106
PID 1632 wrote to memory of 3720	1632	explorer.exe	107
PID 1632 wrote to memory of 3720	1632	explorer.exe	107
PID 1632 wrote to memory of 3720	1632	explorer.exe	107
PID 1632 wrote to memory of 1808	1632	explorer.exe	108
PID 1632 wrote to memory of 1808	1632	explorer.exe	108
PID 1632 wrote to memory of 1808	1632	explorer.exe	108
PID 1632 wrote to memory of 3012	1632	explorer.exe	109
PID 1632 wrote to memory of 3012	1632	explorer.exe	109
PID 1632 wrote to memory of 3012	1632	explorer.exe	109
PID 1632 wrote to memory of 4612	1632	explorer.exe	110
PID 1632 wrote to memory of 4612	1632	explorer.exe	110
PID 1632 wrote to memory of 4612	1632	explorer.exe	110
PID 1632 wrote to memory of 3920	1632	explorer.exe	111
PID 1632 wrote to memory of 3920	1632	explorer.exe	111
PID 1632 wrote to memory of 3920	1632	explorer.exe	111
PID 1632 wrote to memory of 3984	1632	explorer.exe	112
PID 1632 wrote to memory of 3984	1632	explorer.exe	112
PID 1632 wrote to memory of 3984	1632	explorer.exe	112
PID 1632 wrote to memory of 2416	1632	explorer.exe	113
PID 1632 wrote to memory of 2416	1632	explorer.exe	113
PID 1632 wrote to memory of 2416	1632	explorer.exe	113
PID 1632 wrote to memory of 4436	1632	explorer.exe	114
PID 1632 wrote to memory of 4436	1632	explorer.exe	114
PID 1632 wrote to memory of 4436	1632	explorer.exe	114
PID 1632 wrote to memory of 2144	1632	explorer.exe	115
PID 1632 wrote to memory of 2144	1632	explorer.exe	115
PID 1632 wrote to memory of 2144	1632	explorer.exe	115
PID 1632 wrote to memory of 1676	1632	explorer.exe	116
PID 1632 wrote to memory of 1676	1632	explorer.exe	116
PID 1632 wrote to memory of 1676	1632	explorer.exe	116
PID 1632 wrote to memory of 2356	1632	explorer.exe	117
PID 1632 wrote to memory of 2356	1632	explorer.exe	117
PID 1632 wrote to memory of 2356	1632	explorer.exe	117
PID 1632 wrote to memory of 1820	1632	explorer.exe	118
PID 1632 wrote to memory of 1820	1632	explorer.exe	118
PID 1632 wrote to memory of 1820	1632	explorer.exe	118
PID 1632 wrote to memory of 1376	1632	explorer.exe	119
PID 1632 wrote to memory of 1376	1632	explorer.exe	119
PID 1632 wrote to memory of 1376	1632	explorer.exe	119
PID 1632 wrote to memory of 4800	1632	explorer.exe	120
PID 1632 wrote to memory of 4800	1632	explorer.exe	120
PID 1632 wrote to memory of 4800	1632	explorer.exe	120
PID 1632 wrote to memory of 2132	1632	explorer.exe	121
PID 1632 wrote to memory of 2132	1632	explorer.exe	121
PID 1632 wrote to memory of 2132	1632	explorer.exe	121
PID 1632 wrote to memory of 4688	1632	explorer.exe	122

C:\Users\Admin\AppData\Local\Temp\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a440740b9893b2ecd76d0451d91f96af_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3736
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3128
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5576
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5312
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6100
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5268
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4112
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5476
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1204
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5176
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5144
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 4a9dcef05a78fe238703cc6fab95dd1952d4355c42f712c7aa1bfb2c0621f654
MD5 78afc06ed48362bea495b5d13e86e990
SHA1 4e0fc2bef54757acb9a450ebe87ecdbe7302f0fa
SHA512 80d6a62e088908f437615e0171ba23c8624b47c497c2431859387a1b820fd888e9cef51531259526f6d258713863ae071e9b57a854eb6d8fee179369e07fe1df
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 2.2MB
SHA256 fa57221a93de576e06a28be927e20973c78e000899a3c485f221ba4adbc6b3c4
MD5 e8c796188e9e5f2ca7605b12a7f2a2ef
SHA1 61474e4c4293fc1e2a3565b20205fdffa2f7dcbf
SHA512 06c7d53218fde5faac5e3aa190fa65bf067f14570dcdfde48b2862369deac03a4c830a442fc682749aadf09d87cb2fa9bc95c001656fc92ffbd5dc14292d20cc
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWwwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-5602-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/676-1945-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/840-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1180-2654-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1184-2024-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1204-4775-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1204-4888-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1328-2987-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1376-1763-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1392-2023-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1452-5111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1456-2044-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1632-864-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1632-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1644-4767-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-1562-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1800-4685-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-4587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1800-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1808-2049-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1808-1067-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1820-1762-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1892-5013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2016-2994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2028-5001-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2028-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2116-2828-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2132-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2144-1561-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2356-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2400-4994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2416-1407-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2620-2249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2620-2246-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3012-1068-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3012-2115-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3036-2338-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3128-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3128-2369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3684-2836-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3720-1066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3720-2032-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3736-45-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3736-92-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3736-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3736-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3920-1245-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3984-1246-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4112-2979-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4112-3064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4248-5443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4424-2645-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4436-1408-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4448-3504-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-4172-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4496-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/4496-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4496-43-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/4496-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4612-1244-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4688-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4800-1764-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4804-865-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4804-2026-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4856-5433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-2880-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5136-3916-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5144-5420-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5144-5563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5168-2387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5176-5273-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5176-5030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5176-5405-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5184-2204-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5184-2185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5272-2397-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5300-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5300-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5372-4201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5408-2846-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5416-2202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5416-2025-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-2636-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-2634-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5524-2035-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5564-5050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5572-3226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5572-3133-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5592-2664-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5608-2046-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5608-2048-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5620-3600-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5728-3883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5728-3751-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5912-4388-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5912-4275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5952-2118-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6012-2128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6040-4567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6088-2138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6132-5130-0x0000000000400000-0x000000000043E000-memory.dmp

Download