pony | c7d41aaac24952ba3ab46d20f0639d57b4682411e00c0563315aba21db1845ef

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
Size 2.2MB
Sample240613-kfd6ja1dqa
SHA256 c7d41aaac24952ba3ab46d20f0639d57b4682411e00c0563315aba21db1845ef
MD5 a4a567a109ae91f5d9a4155d773de3ff
SHA1 4c91a90fe774ea6180686ea13cee1bbaa99fbdd8
SHA512 4aa5bbd2bcfa9670d3033b09665951ecc8fe866cec9dedd0c52fa92e2a372aa749af0ed2de82394c4a58333474b4583fb70c90a56a1207e86b6bb49ffdfa6316
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3068	explorer.exe
4656	explorer.exe
2480	spoolsv.exe
4120	spoolsv.exe
2700	spoolsv.exe
760	spoolsv.exe
4252	spoolsv.exe
224	spoolsv.exe
2684	spoolsv.exe
4644	spoolsv.exe
5052	spoolsv.exe
2596	spoolsv.exe
2128	spoolsv.exe
3368	spoolsv.exe
1724	spoolsv.exe
3172	spoolsv.exe
4524	spoolsv.exe
4492	spoolsv.exe
1872	spoolsv.exe
3676	spoolsv.exe
1808	spoolsv.exe
3204	spoolsv.exe
2108	spoolsv.exe
1364	spoolsv.exe
3364	spoolsv.exe
3636	spoolsv.exe
4376	spoolsv.exe
4904	spoolsv.exe
3496	spoolsv.exe
3068	spoolsv.exe
2088	spoolsv.exe
2204	spoolsv.exe
4576	spoolsv.exe
2764	spoolsv.exe
4152	explorer.exe
4028	spoolsv.exe
4412	spoolsv.exe
4140	explorer.exe
3320	spoolsv.exe
4872	spoolsv.exe
1492	spoolsv.exe
3976	spoolsv.exe
2300	spoolsv.exe
3940	spoolsv.exe
2812	spoolsv.exe
2848	explorer.exe
4936	spoolsv.exe
3948	spoolsv.exe
1740	spoolsv.exe
2228	spoolsv.exe
832	spoolsv.exe
116	explorer.exe
1712	spoolsv.exe
3688	spoolsv.exe
3088	spoolsv.exe
2904	spoolsv.exe
4176	spoolsv.exe
4972	spoolsv.exe
936	explorer.exe
4296	spoolsv.exe
4548	spoolsv.exe
3592	spoolsv.exe
4856	spoolsv.exe
3952	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 1624 set thread context of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 3068 set thread context of 4656	3068	explorer.exe	91
PID 2480 set thread context of 2764	2480	spoolsv.exe	123
PID 4120 set thread context of 4028	4120	spoolsv.exe	125
PID 2700 set thread context of 4412	2700	spoolsv.exe	126
PID 760 set thread context of 4872	760	spoolsv.exe	129
PID 4252 set thread context of 1492	4252	spoolsv.exe	130
PID 224 set thread context of 3976	224	spoolsv.exe	131
PID 2684 set thread context of 2300	2684	spoolsv.exe	132
PID 4644 set thread context of 2812	4644	spoolsv.exe	134
PID 5052 set thread context of 4936	5052	spoolsv.exe	136
PID 2596 set thread context of 3948	2596	spoolsv.exe	137
PID 2128 set thread context of 1740	2128	spoolsv.exe	138
PID 3368 set thread context of 832	3368	spoolsv.exe	140
PID 1724 set thread context of 1712	1724	spoolsv.exe	142
PID 3172 set thread context of 3688	3172	spoolsv.exe	143
PID 4524 set thread context of 3088	4524	spoolsv.exe	144
PID 4492 set thread context of 2904	4492	spoolsv.exe	145
PID 1872 set thread context of 4972	1872	spoolsv.exe	147
PID 3676 set thread context of 4296	3676	spoolsv.exe	149
PID 1808 set thread context of 4548	1808	spoolsv.exe	150
PID 3204 set thread context of 3592	3204	spoolsv.exe	151
PID 2108 set thread context of 4856	2108	spoolsv.exe	152
PID 1364 set thread context of 3944	1364	spoolsv.exe	155
PID 3364 set thread context of 4284	3364	spoolsv.exe	156
PID 3636 set thread context of 2676	3636	spoolsv.exe	157
PID 4376 set thread context of 1784	4376	spoolsv.exe	158
PID 4904 set thread context of 3584	4904	spoolsv.exe	159
PID 3496 set thread context of 220	3496	spoolsv.exe	161
PID 3068 set thread context of 4516	3068	spoolsv.exe	163
PID 2088 set thread context of 3336	2088	spoolsv.exe	164
PID 2204 set thread context of 412	2204	spoolsv.exe	165
PID 4152 set thread context of 2004	4152	explorer.exe	169
PID 4576 set thread context of 4952	4576	spoolsv.exe	170
PID 4140 set thread context of 1628	4140	explorer.exe	174
PID 3320 set thread context of 4868	3320	spoolsv.exe	176
PID 3940 set thread context of 1572	3940	spoolsv.exe	180
PID 2848 set thread context of 2164	2848	explorer.exe	182
PID 2228 set thread context of 4764	2228	spoolsv.exe	185
PID 116 set thread context of 3956	116	explorer.exe	188
PID 936 set thread context of 3060	936	explorer.exe	191
PID 4176 set thread context of 1264	4176	spoolsv.exe	192
PID 3952 set thread context of 4896	3952	explorer.exe	197
PID 2544 set thread context of 2316	2544	spoolsv.exe	199
PID 3188 set thread context of 1676	3188	explorer.exe	203
PID 2240 set thread context of 212	2240	spoolsv.exe	204
PID 2940 set thread context of 244	2940	spoolsv.exe	206
PID 4436 set thread context of 1820	4436	explorer.exe	207
PID 1804 set thread context of 3240	1804	spoolsv.exe	209
PID 3128 set thread context of 5032	3128	explorer.exe	211
PID 1472 set thread context of 3648	1472	spoolsv.exe	212
PID 1488 set thread context of 4740	1488	spoolsv.exe	214
PID 3996 set thread context of 4428	3996	spoolsv.exe	217
PID 1312 set thread context of 1404	1312	explorer.exe	218
PID 3132 set thread context of 3576	3132	spoolsv.exe	219
PID 996 set thread context of 2948	996	spoolsv.exe	221
PID 2248 set thread context of 1500	2248	explorer.exe	223
PID 1464 set thread context of 3244	1464	spoolsv.exe	224

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4656	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
2764	spoolsv.exe
2764	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
4412	spoolsv.exe
4412	spoolsv.exe
4872	spoolsv.exe
4872	spoolsv.exe
1492	spoolsv.exe
1492	spoolsv.exe
3976	spoolsv.exe
3976	spoolsv.exe
2300	spoolsv.exe
2300	spoolsv.exe
2812	spoolsv.exe
2812	spoolsv.exe
4936	spoolsv.exe
4936	spoolsv.exe
3948	spoolsv.exe
3948	spoolsv.exe
1740	spoolsv.exe
1740	spoolsv.exe
832	spoolsv.exe
832	spoolsv.exe
1712	spoolsv.exe
1712	spoolsv.exe
3688	spoolsv.exe
3688	spoolsv.exe
3088	spoolsv.exe
3088	spoolsv.exe
2904	spoolsv.exe
2904	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
4296	spoolsv.exe
4296	spoolsv.exe
4548	spoolsv.exe
4548	spoolsv.exe
3592	spoolsv.exe
3592	spoolsv.exe
4856	spoolsv.exe
4856	spoolsv.exe
3944	spoolsv.exe
3944	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
2676	spoolsv.exe
2676	spoolsv.exe
1784	spoolsv.exe
1784	spoolsv.exe
3584	spoolsv.exe
3584	spoolsv.exe
220	spoolsv.exe
220	spoolsv.exe
4516	spoolsv.exe
4516	spoolsv.exe
3336	spoolsv.exe
3336	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1396	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	80
PID 1624 wrote to memory of 1396	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	80
PID 1624 wrote to memory of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 1624 wrote to memory of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 1624 wrote to memory of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 1624 wrote to memory of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 1624 wrote to memory of 4676	1624	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	82
PID 4676 wrote to memory of 3068	4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	83
PID 4676 wrote to memory of 3068	4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	83
PID 4676 wrote to memory of 3068	4676	a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe	83
PID 3068 wrote to memory of 4656	3068	explorer.exe	91
PID 3068 wrote to memory of 4656	3068	explorer.exe	91
PID 3068 wrote to memory of 4656	3068	explorer.exe	91
PID 3068 wrote to memory of 4656	3068	explorer.exe	91
PID 3068 wrote to memory of 4656	3068	explorer.exe	91
PID 4656 wrote to memory of 2480	4656	explorer.exe	92
PID 4656 wrote to memory of 2480	4656	explorer.exe	92
PID 4656 wrote to memory of 2480	4656	explorer.exe	92
PID 4656 wrote to memory of 4120	4656	explorer.exe	93
PID 4656 wrote to memory of 4120	4656	explorer.exe	93
PID 4656 wrote to memory of 4120	4656	explorer.exe	93
PID 4656 wrote to memory of 2700	4656	explorer.exe	94
PID 4656 wrote to memory of 2700	4656	explorer.exe	94
PID 4656 wrote to memory of 2700	4656	explorer.exe	94
PID 4656 wrote to memory of 760	4656	explorer.exe	95
PID 4656 wrote to memory of 760	4656	explorer.exe	95
PID 4656 wrote to memory of 760	4656	explorer.exe	95
PID 4656 wrote to memory of 4252	4656	explorer.exe	96
PID 4656 wrote to memory of 4252	4656	explorer.exe	96
PID 4656 wrote to memory of 4252	4656	explorer.exe	96
PID 4656 wrote to memory of 224	4656	explorer.exe	97
PID 4656 wrote to memory of 224	4656	explorer.exe	97
PID 4656 wrote to memory of 224	4656	explorer.exe	97
PID 4656 wrote to memory of 2684	4656	explorer.exe	98
PID 4656 wrote to memory of 2684	4656	explorer.exe	98
PID 4656 wrote to memory of 2684	4656	explorer.exe	98
PID 4656 wrote to memory of 4644	4656	explorer.exe	99
PID 4656 wrote to memory of 4644	4656	explorer.exe	99
PID 4656 wrote to memory of 4644	4656	explorer.exe	99
PID 4656 wrote to memory of 5052	4656	explorer.exe	100
PID 4656 wrote to memory of 5052	4656	explorer.exe	100
PID 4656 wrote to memory of 5052	4656	explorer.exe	100
PID 4656 wrote to memory of 2596	4656	explorer.exe	101
PID 4656 wrote to memory of 2596	4656	explorer.exe	101
PID 4656 wrote to memory of 2596	4656	explorer.exe	101
PID 4656 wrote to memory of 2128	4656	explorer.exe	102
PID 4656 wrote to memory of 2128	4656	explorer.exe	102
PID 4656 wrote to memory of 2128	4656	explorer.exe	102
PID 4656 wrote to memory of 3368	4656	explorer.exe	103
PID 4656 wrote to memory of 3368	4656	explorer.exe	103
PID 4656 wrote to memory of 3368	4656	explorer.exe	103
PID 4656 wrote to memory of 1724	4656	explorer.exe	104
PID 4656 wrote to memory of 1724	4656	explorer.exe	104
PID 4656 wrote to memory of 1724	4656	explorer.exe	104
PID 4656 wrote to memory of 3172	4656	explorer.exe	105
PID 4656 wrote to memory of 3172	4656	explorer.exe	105
PID 4656 wrote to memory of 3172	4656	explorer.exe	105
PID 4656 wrote to memory of 4524	4656	explorer.exe	106
PID 4656 wrote to memory of 4524	4656	explorer.exe	106
PID 4656 wrote to memory of 4524	4656	explorer.exe	106
PID 4656 wrote to memory of 4492	4656	explorer.exe	107
PID 4656 wrote to memory of 4492	4656	explorer.exe	107
PID 4656 wrote to memory of 4492	4656	explorer.exe	107
PID 4656 wrote to memory of 1872	4656	explorer.exe	108

C:\Users\Admin\AppData\Local\Temp\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4a567a109ae91f5d9a4155d773de3ff_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4676
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:936
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3952
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3188
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3128
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1312
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2248
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3240
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 40e1cf13fae185dc9fb6e31d54e3a7152d01c79be85230d9dc1dabd93a28a472
MD5 72476efdfa436b7f4f088047dced1f20
SHA1 b4f56c685f2c38d9ca24db42adc38409e7087e74
SHA512 5e7ea28c96fd98d88cd3f5fecbe7308197b20fb1e8c03f51b0d3ce93c40e593724e367074ccbce4cafbb1743e42cbf1de3a8268a70c362f0282a442f58381f98
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ+:0UzeyQMS4DqodCnoe+iitjWwwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 2.2MB
SHA256 2a1afb83302bf7a644a35771f56f504dbf298dadb5417c0d9976ba2f026f28cf
MD5 79002e5d754ab3097a68dd8e29749607
SHA1 b10c69641d4321e658ed8bb869967b8ba0d50991
SHA512 c153e6990b2964a9760796a63279e58ebfc05f6d1e4ec89791097c6a7bfe88e274ce79d918e6466abb6c398da261b4c12be09f08cf56070d1d60d3e30d539c80
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-4640-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-3073-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-3151-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-1129-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/244-4649-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/412-3279-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/760-932-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/832-2665-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/832-2462-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1264-4134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1364-2006-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1404-5051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-2113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1500-5188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-3711-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1624-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1624-33-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1624-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1624-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1628-3485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-4631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1712-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1724-1646-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1740-2307-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1784-2903-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1784-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1808-1902-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1820-4660-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1872-1822-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2004-3296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2108-1912-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2128-1466-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2164-3720-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2300-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-4439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-4541-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2480-749-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2480-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2596-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2676-2891-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2684-1305-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2700-2009-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2700-931-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2764-1988-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-1904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2812-2272-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2812-2442-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2904-2511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2948-5179-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-4126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3068-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3088-2500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3172-1647-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3204-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3240-4792-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3240-4941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3244-5194-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3244-5199-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3336-3092-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3364-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3368-1467-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3576-5060-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-4810-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-4808-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3676-1823-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3688-2489-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-2872-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3948-2297-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-4000-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-4004-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3976-2123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-1914-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4120-750-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4120-1915-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4252-1128-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4296-2692-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-2008-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-1821-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4516-3081-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-2701-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4644-1306-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4656-748-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4656-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-72-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4676-36-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4740-5020-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4740-5159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4764-3983-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-2990-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-2789-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4868-3518-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-2102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-4422-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4936-2286-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-3304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-3423-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2761-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5032-4813-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5052-1307-0x0000000000400000-0x00000000005D3000-memory.dmp

Download