pony | ee3d4f9d1a6c7f0f319273dea7239697c9b7df94294a9f868f7a6f062d1ef69d

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
Size 2.2MB
Sample240613-j5d2dsvbmk
SHA256 ee3d4f9d1a6c7f0f319273dea7239697c9b7df94294a9f868f7a6f062d1ef69d
MD5 a4938347756a5b1ee55dffafcf581a3b
SHA1 74d321fe62945a4349e4929e6a49bda28a67120f
SHA512 ee2d28d36ff043ca2764ad1a19de3bec2b31207745bbca9e00361ff12e62ad57422fc9e2c246f8d2b581cedf31dbecea896de6c64d6d7ff761b609e328094ac0
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2452	explorer.exe
3624	explorer.exe
1292	spoolsv.exe
4868	spoolsv.exe
8	spoolsv.exe
2060	spoolsv.exe
2520	spoolsv.exe
2200	spoolsv.exe
4760	spoolsv.exe
2088	spoolsv.exe
2020	spoolsv.exe
3776	spoolsv.exe
1732	spoolsv.exe
776	spoolsv.exe
3920	spoolsv.exe
4772	spoolsv.exe
2064	spoolsv.exe
444	spoolsv.exe
1408	spoolsv.exe
2936	spoolsv.exe
1196	spoolsv.exe
2772	spoolsv.exe
4308	spoolsv.exe
2304	spoolsv.exe
1020	spoolsv.exe
1860	spoolsv.exe
712	spoolsv.exe
4780	spoolsv.exe
2664	spoolsv.exe
1088	spoolsv.exe
1592	spoolsv.exe
3236	spoolsv.exe
1004	spoolsv.exe
1816	spoolsv.exe
2836	spoolsv.exe
808	explorer.exe
3984	spoolsv.exe
5216	spoolsv.exe
5272	spoolsv.exe
5360	spoolsv.exe
5440	spoolsv.exe
5500	spoolsv.exe
5844	spoolsv.exe
5892	explorer.exe
3632	spoolsv.exe
5148	spoolsv.exe
4808	spoolsv.exe
5312	spoolsv.exe
5684	spoolsv.exe
5728	explorer.exe
6060	spoolsv.exe
6124	spoolsv.exe
2260	spoolsv.exe
5168	spoolsv.exe
1756	spoolsv.exe
5332	spoolsv.exe
5556	spoolsv.exe
5636	explorer.exe
5952	spoolsv.exe
6004	spoolsv.exe
6100	spoolsv.exe
1208	spoolsv.exe
1796	spoolsv.exe
820	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 2452 set thread context of 3624	2452	explorer.exe	101
PID 1292 set thread context of 2836	1292	spoolsv.exe	134
PID 4868 set thread context of 3984	4868	spoolsv.exe	136
PID 8 set thread context of 5272	8	spoolsv.exe	138
PID 2060 set thread context of 5360	2060	spoolsv.exe	139
PID 2520 set thread context of 5440	2520	spoolsv.exe	140
PID 2200 set thread context of 5500	2200	spoolsv.exe	141
PID 4760 set thread context of 5844	4760	spoolsv.exe	142
PID 2088 set thread context of 5148	2088	spoolsv.exe	145
PID 2020 set thread context of 4808	2020	spoolsv.exe	146
PID 3776 set thread context of 5312	3776	spoolsv.exe	147
PID 1732 set thread context of 5684	1732	spoolsv.exe	149
PID 776 set thread context of 6124	776	spoolsv.exe	152
PID 3920 set thread context of 2260	3920	spoolsv.exe	153
PID 4772 set thread context of 5168	4772	spoolsv.exe	154
PID 2064 set thread context of 1756	2064	spoolsv.exe	155
PID 444 set thread context of 5332	444	spoolsv.exe	156
PID 1408 set thread context of 5556	1408	spoolsv.exe	157
PID 2936 set thread context of 6004	2936	spoolsv.exe	160
PID 1196 set thread context of 6100	1196	spoolsv.exe	161
PID 2772 set thread context of 1208	2772	spoolsv.exe	162
PID 4308 set thread context of 1796	4308	spoolsv.exe	163
PID 2304 set thread context of 5780	2304	spoolsv.exe	166
PID 1020 set thread context of 5984	1020	spoolsv.exe	167
PID 1860 set thread context of 6048	1860	spoolsv.exe	168
PID 712 set thread context of 3944	712	spoolsv.exe	169
PID 4780 set thread context of 2816	4780	spoolsv.exe	170
PID 2664 set thread context of 1476	2664	spoolsv.exe	173
PID 1088 set thread context of 3900	1088	spoolsv.exe	174
PID 1592 set thread context of 6052	1592	spoolsv.exe	176
PID 3236 set thread context of 1616	3236	spoolsv.exe	177
PID 1004 set thread context of 4496	1004	spoolsv.exe	179
PID 1816 set thread context of 4640	1816	spoolsv.exe	185
PID 808 set thread context of 3256	808	explorer.exe	189
PID 5216 set thread context of 5540	5216	spoolsv.exe	191
PID 5892 set thread context of 1416	5892	explorer.exe	195
PID 3632 set thread context of 3840	3632	spoolsv.exe	196
PID 5728 set thread context of 3080	5728	explorer.exe	201
PID 6060 set thread context of 5944	6060	spoolsv.exe	202
PID 5636 set thread context of 5488	5636	explorer.exe	206
PID 5952 set thread context of 2400	5952	spoolsv.exe	208
PID 820 set thread context of 2508	820	explorer.exe	212
PID 1104 set thread context of 4544	1104	spoolsv.exe	213
PID 5484 set thread context of 1928	5484	spoolsv.exe	217
PID 5448 set thread context of 5016	5448	explorer.exe	219
PID 5804 set thread context of 5344	5804	spoolsv.exe	221
PID 4248 set thread context of 2452	4248	explorer.exe	222
PID 1620 set thread context of 5736	1620	spoolsv.exe	223
PID 4208 set thread context of 1000	4208	spoolsv.exe	224
PID 5236 set thread context of 4452	5236	spoolsv.exe	225
PID 2540 set thread context of 5784	2540	spoolsv.exe	227
PID 3228 set thread context of 5692	3228	explorer.exe	228
PID 3316 set thread context of 952	3316	spoolsv.exe	229
PID 5404 set thread context of 4436	5404	spoolsv.exe	231
PID 4804 set thread context of 3800	4804	spoolsv.exe	233
PID 2788 set thread context of 5220	2788	explorer.exe	234
PID 3508 set thread context of 3540	3508	spoolsv.exe	236

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3624	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
3624	explorer.exe
2836	spoolsv.exe
2836	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
5272	spoolsv.exe
5272	spoolsv.exe
5360	spoolsv.exe
5360	spoolsv.exe
5440	spoolsv.exe
5440	spoolsv.exe
5500	spoolsv.exe
5500	spoolsv.exe
5844	spoolsv.exe
5844	spoolsv.exe
5148	spoolsv.exe
5148	spoolsv.exe
4808	spoolsv.exe
4808	spoolsv.exe
5312	spoolsv.exe
5312	spoolsv.exe
5684	spoolsv.exe
5684	spoolsv.exe
6124	spoolsv.exe
6124	spoolsv.exe
2260	spoolsv.exe
2260	spoolsv.exe
5168	spoolsv.exe
5168	spoolsv.exe
1756	spoolsv.exe
1756	spoolsv.exe
5332	spoolsv.exe
5332	spoolsv.exe
5556	spoolsv.exe
5556	spoolsv.exe
6004	spoolsv.exe
6004	spoolsv.exe
6100	spoolsv.exe
6100	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
1796	spoolsv.exe
1796	spoolsv.exe
5780	spoolsv.exe
5780	spoolsv.exe
5984	spoolsv.exe
5984	spoolsv.exe
6048	spoolsv.exe
6048	spoolsv.exe
3944	spoolsv.exe
3944	spoolsv.exe
2816	spoolsv.exe
2816	spoolsv.exe
1476	spoolsv.exe
1476	spoolsv.exe
3900	spoolsv.exe
3900	spoolsv.exe
6052	spoolsv.exe
6052	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1604	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	89
PID 1668 wrote to memory of 1604	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	89
PID 1668 wrote to memory of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 1668 wrote to memory of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 1668 wrote to memory of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 1668 wrote to memory of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 1668 wrote to memory of 5028	1668	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	95
PID 5028 wrote to memory of 2452	5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	96
PID 5028 wrote to memory of 2452	5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	96
PID 5028 wrote to memory of 2452	5028	a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe	96
PID 2452 wrote to memory of 3624	2452	explorer.exe	101
PID 2452 wrote to memory of 3624	2452	explorer.exe	101
PID 2452 wrote to memory of 3624	2452	explorer.exe	101
PID 2452 wrote to memory of 3624	2452	explorer.exe	101
PID 2452 wrote to memory of 3624	2452	explorer.exe	101
PID 3624 wrote to memory of 1292	3624	explorer.exe	102
PID 3624 wrote to memory of 1292	3624	explorer.exe	102
PID 3624 wrote to memory of 1292	3624	explorer.exe	102
PID 3624 wrote to memory of 4868	3624	explorer.exe	103
PID 3624 wrote to memory of 4868	3624	explorer.exe	103
PID 3624 wrote to memory of 4868	3624	explorer.exe	103
PID 3624 wrote to memory of 8	3624	explorer.exe	104
PID 3624 wrote to memory of 8	3624	explorer.exe	104
PID 3624 wrote to memory of 8	3624	explorer.exe	104
PID 3624 wrote to memory of 2060	3624	explorer.exe	105
PID 3624 wrote to memory of 2060	3624	explorer.exe	105
PID 3624 wrote to memory of 2060	3624	explorer.exe	105
PID 3624 wrote to memory of 2520	3624	explorer.exe	106
PID 3624 wrote to memory of 2520	3624	explorer.exe	106
PID 3624 wrote to memory of 2520	3624	explorer.exe	106
PID 3624 wrote to memory of 2200	3624	explorer.exe	107
PID 3624 wrote to memory of 2200	3624	explorer.exe	107
PID 3624 wrote to memory of 2200	3624	explorer.exe	107
PID 3624 wrote to memory of 4760	3624	explorer.exe	108
PID 3624 wrote to memory of 4760	3624	explorer.exe	108
PID 3624 wrote to memory of 4760	3624	explorer.exe	108
PID 3624 wrote to memory of 2088	3624	explorer.exe	109
PID 3624 wrote to memory of 2088	3624	explorer.exe	109
PID 3624 wrote to memory of 2088	3624	explorer.exe	109
PID 3624 wrote to memory of 2020	3624	explorer.exe	110
PID 3624 wrote to memory of 2020	3624	explorer.exe	110
PID 3624 wrote to memory of 2020	3624	explorer.exe	110
PID 3624 wrote to memory of 3776	3624	explorer.exe	111
PID 3624 wrote to memory of 3776	3624	explorer.exe	111
PID 3624 wrote to memory of 3776	3624	explorer.exe	111
PID 3624 wrote to memory of 1732	3624	explorer.exe	112
PID 3624 wrote to memory of 1732	3624	explorer.exe	112
PID 3624 wrote to memory of 1732	3624	explorer.exe	112
PID 3624 wrote to memory of 776	3624	explorer.exe	113
PID 3624 wrote to memory of 776	3624	explorer.exe	113
PID 3624 wrote to memory of 776	3624	explorer.exe	113
PID 3624 wrote to memory of 3920	3624	explorer.exe	114
PID 3624 wrote to memory of 3920	3624	explorer.exe	114
PID 3624 wrote to memory of 3920	3624	explorer.exe	114
PID 3624 wrote to memory of 4772	3624	explorer.exe	115
PID 3624 wrote to memory of 4772	3624	explorer.exe	115
PID 3624 wrote to memory of 4772	3624	explorer.exe	115
PID 3624 wrote to memory of 2064	3624	explorer.exe	116
PID 3624 wrote to memory of 2064	3624	explorer.exe	116
PID 3624 wrote to memory of 2064	3624	explorer.exe	116
PID 3624 wrote to memory of 444	3624	explorer.exe	117
PID 3624 wrote to memory of 444	3624	explorer.exe	117
PID 3624 wrote to memory of 444	3624	explorer.exe	117
PID 3624 wrote to memory of 1408	3624	explorer.exe	118

C:\Users\Admin\AppData\Local\Temp\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4938347756a5b1ee55dffafcf581a3b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5028
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5556
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5636
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:820
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4248
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2788
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3840
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2432
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4312,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
1⤵
PID:712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 4344f0c36328db3754579c56cec8437046bba77bec62017c0390a706bbeef9d1
MD5 671a2d5d8bc41d77e3f52d154b494c4e
SHA1 cfa45b562c1ab20a1567cc60f58c581350d6bf3a
SHA512 60897a5f410b89756a2a0a10fb6fcd2c6b0f3466f260ae741485adb5ee472a61d5babf286a5c442033d11d751fdda91f066d21b780adc0fd696a984e4d76e413
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 978ac0353d51f4933e24a430901c2bd1c188c6ade972c523e76b22e57268cece
MD5 2bc06cee84c3078b00b9e4b2821b45c4
SHA1 df9c11a663420cf62d02c8af31ae3751499058e2
SHA512 ce47a9ff5ed9b3a8576265198ef81d2d27a7eea18e4089efae0ead4c6cacbe0d88b8addb0e6a3b5d269e558f18f4a66bcb41c4f926144ee079507bf27751fa31
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-2250-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/8-1136-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/444-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/776-1697-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/952-5570-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/952-5573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1020-2248-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1196-2095-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1208-2919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1292-944-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1292-2166-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1408-2093-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1416-4368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-3305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1616-3494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1616-3617-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1668-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1668-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1668-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1668-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1732-1696-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1796-3010-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1860-2261-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1928-5531-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1928-5360-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2004-5942-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2004-6032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2020-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2060-2259-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2060-1137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2064-1898-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2088-1516-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2200-1319-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2260-2677-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-2173-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2400-5052-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2400-4925-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2452-88-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2452-5473-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-5135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2520-1318-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2772-2163-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2816-3284-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2816-3477-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-2165-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-2340-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2936-2094-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3080-4690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3256-4057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-5809-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-943-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3776-1518-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3800-5717-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-4373-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-4513-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3900-3312-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3920-1698-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3984-2174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2164-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4436-5699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-5691-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-5542-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4496-3504-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-5268-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4640-3985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4640-3852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-1320-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4772-1897-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4808-2474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4868-1135-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4868-2175-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5016-5369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-45-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5148-2457-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5168-2688-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5220-5728-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5272-2249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5272-2253-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5312-2483-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5332-2711-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5332-2707-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5344-5458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5360-2262-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5440-2274-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5488-4861-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5500-2287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5500-2283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5536-5985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5540-4142-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5540-4266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5556-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5556-2988-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5632-5958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5684-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5684-2578-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5692-5563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5736-5480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5780-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5784-5553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-2558-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-2364-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5944-4803-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5944-4699-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5984-3132-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6004-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6048-3144-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6052-3397-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6100-2910-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6124-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Download