pony | 42f10c0b663895ab32a821dca2ae8a163ad16f3c20fbe4e18af71cca2f98403c

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
Size 2.2MB
Sample240613-hvdgfaydkc
SHA256 42f10c0b663895ab32a821dca2ae8a163ad16f3c20fbe4e18af71cca2f98403c
MD5 a4556baa09287892ccb862a462cc908d
SHA1 b420fe54c9dea03529e84e3d0518425d5b1aa0a0
SHA512 40cf0c85d4eca5d98fd41e572210e7aef1889edcb5a842396b387e95fef20dc50b36e8039d3a0c5a93b8eaed8b6b4d5d1af49d48879188f516f4abe6fde80145
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwww
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1656	explorer.exe
4188	explorer.exe
3204	spoolsv.exe
384	spoolsv.exe
904	spoolsv.exe
3616	spoolsv.exe
3996	spoolsv.exe
4612	spoolsv.exe
2208	spoolsv.exe
2804	spoolsv.exe
5108	spoolsv.exe
2944	spoolsv.exe
1756	spoolsv.exe
1456	spoolsv.exe
2284	spoolsv.exe
2864	spoolsv.exe
4840	spoolsv.exe
4308	spoolsv.exe
3760	spoolsv.exe
4648	spoolsv.exe
2752	spoolsv.exe
1516	spoolsv.exe
3688	spoolsv.exe
4348	spoolsv.exe
3384	spoolsv.exe
1180	spoolsv.exe
4272	spoolsv.exe
3208	spoolsv.exe
5084	spoolsv.exe
4140	spoolsv.exe
3064	spoolsv.exe
1920	spoolsv.exe
2128	spoolsv.exe
8	spoolsv.exe
5104	explorer.exe
2468	spoolsv.exe
1556	spoolsv.exe
2120	spoolsv.exe
2464	spoolsv.exe
3288	spoolsv.exe
2844	spoolsv.exe
4220	spoolsv.exe
1648	explorer.exe
1812	spoolsv.exe
2124	spoolsv.exe
1992	spoolsv.exe
3712	spoolsv.exe
4528	spoolsv.exe
4656	spoolsv.exe
1004	spoolsv.exe
4280	spoolsv.exe
3728	explorer.exe
2800	spoolsv.exe
1472	spoolsv.exe
5004	spoolsv.exe
4372	spoolsv.exe
2424	spoolsv.exe
4056	explorer.exe
2512	spoolsv.exe
2948	spoolsv.exe
1184	spoolsv.exe
4888	spoolsv.exe
2576	spoolsv.exe
1552	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 49 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 1656 set thread context of 4188	1656	explorer.exe	92
PID 3204 set thread context of 8	3204	spoolsv.exe	124
PID 384 set thread context of 2468	384	spoolsv.exe	126
PID 904 set thread context of 2120	904	spoolsv.exe	128
PID 3616 set thread context of 2464	3616	spoolsv.exe	129
PID 3996 set thread context of 3288	3996	spoolsv.exe	130
PID 4612 set thread context of 2844	4612	spoolsv.exe	131
PID 2208 set thread context of 4220	2208	spoolsv.exe	132
PID 2804 set thread context of 1812	2804	spoolsv.exe	134
PID 5108 set thread context of 2124	5108	spoolsv.exe	135
PID 2944 set thread context of 3712	2944	spoolsv.exe	137
PID 1756 set thread context of 4528	1756	spoolsv.exe	138
PID 1456 set thread context of 4656	1456	spoolsv.exe	139
PID 2284 set thread context of 1004	2284	spoolsv.exe	140
PID 2864 set thread context of 4280	2864	spoolsv.exe	141
PID 4840 set thread context of 2800	4840	spoolsv.exe	143
PID 4308 set thread context of 1472	4308	spoolsv.exe	165
PID 3760 set thread context of 4372	3760	spoolsv.exe	146
PID 4648 set thread context of 2424	4648	spoolsv.exe	147
PID 2752 set thread context of 2512	2752	spoolsv.exe	149
PID 1516 set thread context of 2948	1516	spoolsv.exe	150
PID 3688 set thread context of 4888	3688	spoolsv.exe	152
PID 4348 set thread context of 2576	4348	spoolsv.exe	153
PID 3384 set thread context of 1552	3384	spoolsv.exe	154
PID 1180 set thread context of 3608	1180	spoolsv.exe	155
PID 4272 set thread context of 5112	4272	spoolsv.exe	157
PID 3208 set thread context of 3964	3208	spoolsv.exe	159
PID 5084 set thread context of 364	5084	spoolsv.exe	160
PID 4140 set thread context of 4700	4140	spoolsv.exe	162
PID 3064 set thread context of 3564	3064	spoolsv.exe	164
PID 1920 set thread context of 3548	1920	spoolsv.exe	166
PID 2128 set thread context of 1656	2128	spoolsv.exe	170
PID 5104 set thread context of 4028	5104	explorer.exe	174
PID 1556 set thread context of 2100	1556	spoolsv.exe	177
PID 1992 set thread context of 3244	1992	spoolsv.exe	185
PID 3728 set thread context of 3696	3728	explorer.exe	187
PID 5004 set thread context of 2248	5004	spoolsv.exe	190
PID 4056 set thread context of 1604	4056	explorer.exe	194
PID 1184 set thread context of 2900	1184	spoolsv.exe	195
PID 5016 set thread context of 4800	5016	spoolsv.exe	199
PID 3192 set thread context of 452	3192	explorer.exe	201
PID 1356 set thread context of 3884	1356	spoolsv.exe	203
PID 4596 set thread context of 4640	4596	explorer.exe	204
PID 1472 set thread context of 4848	1472	spoolsv.exe	206
PID 3060 set thread context of 4104	3060	spoolsv.exe	208
PID 1192 set thread context of 2328	1192	spoolsv.exe	209
PID 2828 set thread context of 4512	2828	spoolsv.exe	210
PID 1828 set thread context of 2188	1828	explorer.exe	211

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4188	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
4188	explorer.exe
8	spoolsv.exe
8	spoolsv.exe
2468	spoolsv.exe
2468	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2464	spoolsv.exe
2464	spoolsv.exe
3288	spoolsv.exe
3288	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
4220	spoolsv.exe
4220	spoolsv.exe
1812	spoolsv.exe
1812	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
3712	spoolsv.exe
3712	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
4656	spoolsv.exe
4656	spoolsv.exe
1004	spoolsv.exe
1004	spoolsv.exe
4280	spoolsv.exe
4280	spoolsv.exe
2800	spoolsv.exe
2800	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
4372	spoolsv.exe
4372	spoolsv.exe
2424	spoolsv.exe
2424	spoolsv.exe
2512	spoolsv.exe
2512	spoolsv.exe
2948	spoolsv.exe
2948	spoolsv.exe
4888	spoolsv.exe
4888	spoolsv.exe
2576	spoolsv.exe
2576	spoolsv.exe
1552	spoolsv.exe
1552	spoolsv.exe
3608	spoolsv.exe
3608	spoolsv.exe
5112	spoolsv.exe
5112	spoolsv.exe
3964	spoolsv.exe
3964	spoolsv.exe
364	spoolsv.exe
364	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
3564	spoolsv.exe
3564	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1608	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	82
PID 1572 wrote to memory of 1608	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	82
PID 1572 wrote to memory of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 1572 wrote to memory of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 1572 wrote to memory of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 1572 wrote to memory of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 1572 wrote to memory of 2756	1572	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	87
PID 2756 wrote to memory of 1656	2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	88
PID 2756 wrote to memory of 1656	2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	88
PID 2756 wrote to memory of 1656	2756	a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe	88
PID 1656 wrote to memory of 4188	1656	explorer.exe	92
PID 1656 wrote to memory of 4188	1656	explorer.exe	92
PID 1656 wrote to memory of 4188	1656	explorer.exe	92
PID 1656 wrote to memory of 4188	1656	explorer.exe	92
PID 1656 wrote to memory of 4188	1656	explorer.exe	92
PID 4188 wrote to memory of 3204	4188	explorer.exe	93
PID 4188 wrote to memory of 3204	4188	explorer.exe	93
PID 4188 wrote to memory of 3204	4188	explorer.exe	93
PID 4188 wrote to memory of 384	4188	explorer.exe	94
PID 4188 wrote to memory of 384	4188	explorer.exe	94
PID 4188 wrote to memory of 384	4188	explorer.exe	94
PID 4188 wrote to memory of 904	4188	explorer.exe	95
PID 4188 wrote to memory of 904	4188	explorer.exe	95
PID 4188 wrote to memory of 904	4188	explorer.exe	95
PID 4188 wrote to memory of 3616	4188	explorer.exe	96
PID 4188 wrote to memory of 3616	4188	explorer.exe	96
PID 4188 wrote to memory of 3616	4188	explorer.exe	96
PID 4188 wrote to memory of 3996	4188	explorer.exe	97
PID 4188 wrote to memory of 3996	4188	explorer.exe	97
PID 4188 wrote to memory of 3996	4188	explorer.exe	97
PID 4188 wrote to memory of 4612	4188	explorer.exe	98
PID 4188 wrote to memory of 4612	4188	explorer.exe	98
PID 4188 wrote to memory of 4612	4188	explorer.exe	98
PID 4188 wrote to memory of 2208	4188	explorer.exe	99
PID 4188 wrote to memory of 2208	4188	explorer.exe	99
PID 4188 wrote to memory of 2208	4188	explorer.exe	99
PID 4188 wrote to memory of 2804	4188	explorer.exe	100
PID 4188 wrote to memory of 2804	4188	explorer.exe	100
PID 4188 wrote to memory of 2804	4188	explorer.exe	100
PID 4188 wrote to memory of 5108	4188	explorer.exe	101
PID 4188 wrote to memory of 5108	4188	explorer.exe	101
PID 4188 wrote to memory of 5108	4188	explorer.exe	101
PID 4188 wrote to memory of 2944	4188	explorer.exe	102
PID 4188 wrote to memory of 2944	4188	explorer.exe	102
PID 4188 wrote to memory of 2944	4188	explorer.exe	102
PID 4188 wrote to memory of 1756	4188	explorer.exe	103
PID 4188 wrote to memory of 1756	4188	explorer.exe	103
PID 4188 wrote to memory of 1756	4188	explorer.exe	103
PID 4188 wrote to memory of 1456	4188	explorer.exe	104
PID 4188 wrote to memory of 1456	4188	explorer.exe	104
PID 4188 wrote to memory of 1456	4188	explorer.exe	104
PID 4188 wrote to memory of 2284	4188	explorer.exe	105
PID 4188 wrote to memory of 2284	4188	explorer.exe	105
PID 4188 wrote to memory of 2284	4188	explorer.exe	105
PID 4188 wrote to memory of 2864	4188	explorer.exe	106
PID 4188 wrote to memory of 2864	4188	explorer.exe	106
PID 4188 wrote to memory of 2864	4188	explorer.exe	106
PID 4188 wrote to memory of 4840	4188	explorer.exe	107
PID 4188 wrote to memory of 4840	4188	explorer.exe	107
PID 4188 wrote to memory of 4840	4188	explorer.exe	107
PID 4188 wrote to memory of 4308	4188	explorer.exe	108
PID 4188 wrote to memory of 4308	4188	explorer.exe	108
PID 4188 wrote to memory of 4308	4188	explorer.exe	108
PID 4188 wrote to memory of 3760	4188	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4556baa09287892ccb862a462cc908d_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:1648
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4056
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3192
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4596
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1656
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1828
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2100
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4848
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4300
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 954b864e123d48b297a192d9cfb3f94bad9e7742eaeceb0dfc4dcc6b41afb4ee
MD5 dd31cefe39fd7535ded0ce6f780a7e0d
SHA1 949b1339789049b4dbfab147a8ce5f54c53ffb8f
SHA512 ab8548ebef5d915c8c6c522d58568cdd588c479ac6fe9f72a34f7a541e3071a86f698fddd5eb3deae34305bbe1c5529df8e655c46c51f0a13934a808c9f73e89
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ0:0UzeyQMS4DqodCnoe+iitjWwwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 8f54b788680ffef55d2e6683a0fa452ff9d2a22e3876f63c145c56a82e2b0ac0
MD5 bbd7b40ce8eeb6c9086bebe343e74c06
SHA1 d29301b8ca2f9ff96aad6e7293944ca104dd2927
SHA512 2b956f305736f5c3681e9236f95418cb63e79d2d32a96e8a0be7d42ba6f202bf5836fe573f48f71d6765d7f3331a6b3c4deded9fd96d2c65b6250174cc625fc2
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-2336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/8-2140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/364-2867-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/384-1124-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/384-2147-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/452-4831-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/904-2235-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/904-1125-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1456-1696-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1472-2537-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1516-2137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1552-2743-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1572-0-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/1572-43-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/1572-48-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1580-4075-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1604-4564-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-98-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1656-3383-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-3536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1656-103-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1756-1695-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1812-2374-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1812-2369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2100-3863-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2100-3756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-2234-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-2236-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/2124-2421-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2124-2396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2188-5037-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2208-1264-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2248-4346-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2284-1697-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2424-2827-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2424-2634-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2464-2247-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-2150-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2512-2644-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2512-2641-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-2136-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2756-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2756-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2756-87-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2800-2528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2804-1470-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2844-2342-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2864-1906-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2900-4697-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-1472-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2948-2652-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2948-2655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3204-2139-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3204-928-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3244-4170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3288-2261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3384-2232-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3548-3140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3548-3108-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-3042-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3564-3040-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3608-2767-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3616-1126-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3616-2246-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3688-2138-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3696-4180-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-2456-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3760-2067-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3964-2859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-1262-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4028-3615-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4104-5007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4188-927-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4188-102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4220-2362-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4280-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-5399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4348-2151-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4372-2571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-5027-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4528-2463-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4612-1263-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4640-4924-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4648-2068-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4656-2474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4700-3128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-5218-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-4910-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-4782-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4840-1907-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4848-4999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-5114-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4888-2727-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4888-2723-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-5423-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-5426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-5408-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-5574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5108-1471-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5112-2849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-3003-0x0000000000400000-0x000000000043E000-memory.dmp

Download