pony | d2097e9c1f57fb617f9207d22b4dd323d8e8fbeeeaa33e9ed5029ebc3f153f28

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
Size

2.2MB
MD5

a4a19b19b62cbc664a5e6861d97fcc12
SHA1

1c44572e97e20c3778087d3944423bd5e9b31ef2
SHA256

d2097e9c1f57fb617f9207d22b4dd323d8e8fbeeeaa33e9ed5029ebc3f153f28
SHA512

57dc9d08eb45e50d24d641244f7450d7a5d215f9ede8dc5eeb7bab4c32b1cf6c26cd1326b6e4f96873bd73f8c88cdf6ada615e4e7cba25077c281d38007f8954
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwS

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
5004	explorer.exe
2676	explorer.exe
2624	spoolsv.exe
3908	spoolsv.exe
1676	spoolsv.exe
5016	spoolsv.exe
2364	spoolsv.exe
4816	spoolsv.exe
3672	spoolsv.exe
3800	spoolsv.exe
1648	spoolsv.exe
2388	spoolsv.exe
4964	spoolsv.exe
948	spoolsv.exe
4088	spoolsv.exe
2024	spoolsv.exe
4740	spoolsv.exe
436	spoolsv.exe
860	spoolsv.exe
996	spoolsv.exe
2680	spoolsv.exe
4324	spoolsv.exe
2084	spoolsv.exe
1800	spoolsv.exe
1628	spoolsv.exe
1988	spoolsv.exe
1312	spoolsv.exe
1568	spoolsv.exe
5008	spoolsv.exe
4608	spoolsv.exe
4660	spoolsv.exe
1076	spoolsv.exe
1720	spoolsv.exe
2132	explorer.exe
2472	spoolsv.exe
1544	spoolsv.exe
3368	spoolsv.exe
644	spoolsv.exe
4804	spoolsv.exe
1616	spoolsv.exe
1012	explorer.exe
2656	spoolsv.exe
5048	spoolsv.exe
3220	spoolsv.exe
4948	spoolsv.exe
2804	spoolsv.exe
4472	spoolsv.exe
4468	explorer.exe
3912	spoolsv.exe
4440	spoolsv.exe
4304	spoolsv.exe
1284	spoolsv.exe
2440	spoolsv.exe
3584	spoolsv.exe
708	spoolsv.exe
4560	spoolsv.exe
3828	explorer.exe
3720	spoolsv.exe
3528	spoolsv.exe
4904	spoolsv.exe
5084	spoolsv.exe
3056	spoolsv.exe
1820	spoolsv.exe
2756	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 53 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 5004 set thread context of 2676	5004	explorer.exe	96
PID 2624 set thread context of 1720	2624	spoolsv.exe	127
PID 3908 set thread context of 2472	3908	spoolsv.exe	129
PID 1676 set thread context of 1544	1676	spoolsv.exe	130
PID 5016 set thread context of 644	5016	spoolsv.exe	132
PID 2364 set thread context of 4804	2364	spoolsv.exe	133
PID 4816 set thread context of 1616	4816	spoolsv.exe	134
PID 3672 set thread context of 2656	3672	spoolsv.exe	136
PID 3800 set thread context of 3220	3800	spoolsv.exe	138
PID 1648 set thread context of 4948	1648	spoolsv.exe	139
PID 2388 set thread context of 2804	2388	spoolsv.exe	140
PID 4964 set thread context of 4472	4964	spoolsv.exe	141
PID 948 set thread context of 4440	948	spoolsv.exe	144
PID 4088 set thread context of 4304	4088	spoolsv.exe	145
PID 2024 set thread context of 1284	2024	spoolsv.exe	146
PID 4740 set thread context of 2440	4740	spoolsv.exe	147
PID 436 set thread context of 3584	436	spoolsv.exe	148
PID 860 set thread context of 4560	860	spoolsv.exe	150
PID 996 set thread context of 3720	996	spoolsv.exe	152
PID 2680 set thread context of 3528	2680	spoolsv.exe	153
PID 4324 set thread context of 4904	4324	spoolsv.exe	154
PID 2084 set thread context of 5084	2084	spoolsv.exe	155
PID 1800 set thread context of 1820	1800	spoolsv.exe	157
PID 1628 set thread context of 1448	1628	spoolsv.exe	159
PID 1988 set thread context of 2764	1988	spoolsv.exe	160
PID 1312 set thread context of 4184	1312	spoolsv.exe	162
PID 1568 set thread context of 3092	1568	spoolsv.exe	163
PID 5008 set thread context of 764	5008	spoolsv.exe	165
PID 4608 set thread context of 2476	4608	spoolsv.exe	166
PID 4660 set thread context of 3624	4660	spoolsv.exe	168
PID 1076 set thread context of 2852	1076	spoolsv.exe	172
PID 2132 set thread context of 3780	2132	explorer.exe	175
PID 3368 set thread context of 2260	3368	spoolsv.exe	177
PID 1012 set thread context of 220	1012	explorer.exe	181
PID 5048 set thread context of 3416	5048	spoolsv.exe	183
PID 4468 set thread context of 4928	4468	explorer.exe	188
PID 3912 set thread context of 1028	3912	spoolsv.exe	189
PID 708 set thread context of 3788	708	spoolsv.exe	194
PID 3828 set thread context of 5108	3828	explorer.exe	196
PID 3056 set thread context of 1432	3056	spoolsv.exe	199
PID 2756 set thread context of 5060	2756	explorer.exe	202
PID 4308 set thread context of 1572	4308	spoolsv.exe	205
PID 1472 set thread context of 3840	1472	explorer.exe	207
PID 2812 set thread context of 4628	2812	spoolsv.exe	208
PID 212 set thread context of 3932	212	explorer.exe	209
PID 2080 set thread context of 1916	2080	spoolsv.exe	210
PID 4992 set thread context of 4932	4992	spoolsv.exe	211
PID 2784 set thread context of 1980	2784	explorer.exe	212
PID 2464 set thread context of 5064	2464	spoolsv.exe	214
PID 4736 set thread context of 636	4736	spoolsv.exe	217
PID 2492 set thread context of 656	2492	explorer.exe	218
PID 2692 set thread context of 1240	2692	spoolsv.exe	219

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
1720	spoolsv.exe
1720	spoolsv.exe
2472	spoolsv.exe
2472	spoolsv.exe
1544	spoolsv.exe
1544	spoolsv.exe
644	spoolsv.exe
644	spoolsv.exe
4804	spoolsv.exe
4804	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
3220	spoolsv.exe
3220	spoolsv.exe
4948	spoolsv.exe
4948	spoolsv.exe
2804	spoolsv.exe
2804	spoolsv.exe
4472	spoolsv.exe
4472	spoolsv.exe
4440	spoolsv.exe
4440	spoolsv.exe
4304	spoolsv.exe
4304	spoolsv.exe
1284	spoolsv.exe
1284	spoolsv.exe
2440	spoolsv.exe
2440	spoolsv.exe
3584	spoolsv.exe
3584	spoolsv.exe
4560	spoolsv.exe
4560	spoolsv.exe
3720	spoolsv.exe
3720	spoolsv.exe
3528	spoolsv.exe
3528	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
5084	spoolsv.exe
5084	spoolsv.exe
1820	spoolsv.exe
1820	spoolsv.exe
1448	spoolsv.exe
1448	spoolsv.exe
2764	spoolsv.exe
2764	spoolsv.exe
4184	spoolsv.exe
4184	spoolsv.exe
3092	spoolsv.exe
3092	spoolsv.exe
764	spoolsv.exe
764	spoolsv.exe
2476	spoolsv.exe
2476	spoolsv.exe
3624	spoolsv.exe
3624	spoolsv.exe
2852	spoolsv.exe
2852	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 348	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	83
PID 1416 wrote to memory of 348	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	83
PID 1416 wrote to memory of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 1416 wrote to memory of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 1416 wrote to memory of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 1416 wrote to memory of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 1416 wrote to memory of 4612	1416	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	87
PID 4612 wrote to memory of 5004	4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	88
PID 4612 wrote to memory of 5004	4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	88
PID 4612 wrote to memory of 5004	4612	a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe	88
PID 5004 wrote to memory of 2676	5004	explorer.exe	96
PID 5004 wrote to memory of 2676	5004	explorer.exe	96
PID 5004 wrote to memory of 2676	5004	explorer.exe	96
PID 5004 wrote to memory of 2676	5004	explorer.exe	96
PID 5004 wrote to memory of 2676	5004	explorer.exe	96
PID 2676 wrote to memory of 2624	2676	explorer.exe	97
PID 2676 wrote to memory of 2624	2676	explorer.exe	97
PID 2676 wrote to memory of 2624	2676	explorer.exe	97
PID 2676 wrote to memory of 3908	2676	explorer.exe	98
PID 2676 wrote to memory of 3908	2676	explorer.exe	98
PID 2676 wrote to memory of 3908	2676	explorer.exe	98
PID 2676 wrote to memory of 1676	2676	explorer.exe	99
PID 2676 wrote to memory of 1676	2676	explorer.exe	99
PID 2676 wrote to memory of 1676	2676	explorer.exe	99
PID 2676 wrote to memory of 5016	2676	explorer.exe	100
PID 2676 wrote to memory of 5016	2676	explorer.exe	100
PID 2676 wrote to memory of 5016	2676	explorer.exe	100
PID 2676 wrote to memory of 2364	2676	explorer.exe	101
PID 2676 wrote to memory of 2364	2676	explorer.exe	101
PID 2676 wrote to memory of 2364	2676	explorer.exe	101
PID 2676 wrote to memory of 4816	2676	explorer.exe	102
PID 2676 wrote to memory of 4816	2676	explorer.exe	102
PID 2676 wrote to memory of 4816	2676	explorer.exe	102
PID 2676 wrote to memory of 3672	2676	explorer.exe	103
PID 2676 wrote to memory of 3672	2676	explorer.exe	103
PID 2676 wrote to memory of 3672	2676	explorer.exe	103
PID 2676 wrote to memory of 3800	2676	explorer.exe	104
PID 2676 wrote to memory of 3800	2676	explorer.exe	104
PID 2676 wrote to memory of 3800	2676	explorer.exe	104
PID 2676 wrote to memory of 1648	2676	explorer.exe	105
PID 2676 wrote to memory of 1648	2676	explorer.exe	105
PID 2676 wrote to memory of 1648	2676	explorer.exe	105
PID 2676 wrote to memory of 2388	2676	explorer.exe	106
PID 2676 wrote to memory of 2388	2676	explorer.exe	106
PID 2676 wrote to memory of 2388	2676	explorer.exe	106
PID 2676 wrote to memory of 4964	2676	explorer.exe	107
PID 2676 wrote to memory of 4964	2676	explorer.exe	107
PID 2676 wrote to memory of 4964	2676	explorer.exe	107
PID 2676 wrote to memory of 948	2676	explorer.exe	108
PID 2676 wrote to memory of 948	2676	explorer.exe	108
PID 2676 wrote to memory of 948	2676	explorer.exe	108
PID 2676 wrote to memory of 4088	2676	explorer.exe	109
PID 2676 wrote to memory of 4088	2676	explorer.exe	109
PID 2676 wrote to memory of 4088	2676	explorer.exe	109
PID 2676 wrote to memory of 2024	2676	explorer.exe	110
PID 2676 wrote to memory of 2024	2676	explorer.exe	110
PID 2676 wrote to memory of 2024	2676	explorer.exe	110
PID 2676 wrote to memory of 4740	2676	explorer.exe	111
PID 2676 wrote to memory of 4740	2676	explorer.exe	111
PID 2676 wrote to memory of 4740	2676	explorer.exe	111
PID 2676 wrote to memory of 436	2676	explorer.exe	112
PID 2676 wrote to memory of 436	2676	explorer.exe	112
PID 2676 wrote to memory of 436	2676	explorer.exe	112
PID 2676 wrote to memory of 860	2676	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:348
- C:\Users\Admin\AppData\Local\Temp\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4a19b19b62cbc664a5e6861d97fcc12_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4612
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2132
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3828
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2756
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1472
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2784
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2492
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3068
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1028
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3788
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1240
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
e3d959b4d3e79b4246785d6a4b3a0cbe

SHA1
f704bc39dd4be9362cd1b6567becebd24b778958

SHA256
e5edeef6a340f3e1c793bf2c786f38d255df2bffe11aef4d9561dbbd51b4e8e3

SHA512
c755b3ca8d17ad5417373d1e18ff9da2335fce1328727b3a8a7e8a847b44b06b8e3b672019e9394db72dbf018b7f5a06e9aad442012197398d4ea135c3a73962

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
dfb29827acb64d76dcd47482ffe5a681

SHA1
5386de63e1f3e38e70cdb8dc64b709579ae08492

SHA256
2c0177249cf2c8cdd142a6af374c6a55abdc12156de9fc8ffe3143c2ac0e5572

SHA512
7ba6ab52c5c905e169489201509b79eae00f6382258ecd5fbd3a0527093117a0b61d2545a5ae87e27c37cf80d31ecd41494e2fe8284b6b34ecda45b3f70ab6ab

Download Submit
memory/220-3755-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-1837-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/644-2083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/656-5000-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/764-2993-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/860-1838-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/948-1519-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/996-1839-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1028-4118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-4056-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1240-5187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1284-2493-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1416-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1416-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1416-33-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1416-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1432-4455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-4558-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-2821-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-2021-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1572-4706-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-2167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-2339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1648-1309-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1652-5208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1676-2047-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1676-998-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1720-1971-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1720-2149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1800-2020-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1820-2968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1820-2814-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-4747-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1980-4767-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-1708-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2084-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2260-3571-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-3663-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2364-1165-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2388-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2440-2504-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2472-1979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2476-3005-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-5313-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2596-5302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2624-801-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2624-1967-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2656-2172-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2676-86-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2676-800-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2680-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2764-2835-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2764-2832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-2278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-3358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-3480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3092-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3092-3129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-2256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-2258-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-3820-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-3909-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3528-2641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3584-2517-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3584-2515-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-3264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-3136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3672-1307-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3720-2630-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3780-3536-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3788-4376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3788-4258-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3800-1308-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3840-4719-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3908-997-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3908-1980-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4088-1707-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4184-2928-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4304-2482-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4324-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4440-2472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-2373-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-72-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4612-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4628-4725-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4628-4729-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-1709-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4804-2094-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4816-1166-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-2651-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4928-4049-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-4755-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4948-2267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-1518-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5004-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5004-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5016-999-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5060-4521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5064-4904-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5064-5028-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-2662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-2659-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5108-4268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download