pony | 3add1559abe5d70fe44c619f423ae6fde90551341274f66530ca3e76c886d85a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
Size 2.2MB
Sample240613-khceqa1emg
SHA256 3add1559abe5d70fe44c619f423ae6fde90551341274f66530ca3e76c886d85a
MD5 a4a8b1c8948019c40555bebda1f1aa8a
SHA1 81305fdaeceb19f1b27e36840d88d4f81642d695
SHA512 224a2bb11e1cc7bc04ee276bc3da1166f4183966993a243ca4fa1e2757388e73b24b147eab6252284446ae8b57aa928e2d586efd2048c0435fc9f0c82ca91085
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZf:0UzeyQMS4DqodCnoe+iitjWwwz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
632	explorer.exe
4072	explorer.exe
1072	spoolsv.exe
5084	spoolsv.exe
3296	spoolsv.exe
396	spoolsv.exe
688	spoolsv.exe
4372	spoolsv.exe
1084	spoolsv.exe
2804	spoolsv.exe
3068	spoolsv.exe
1388	spoolsv.exe
3380	spoolsv.exe
1448	spoolsv.exe
3772	spoolsv.exe
4436	spoolsv.exe
2724	spoolsv.exe
3456	spoolsv.exe
1076	spoolsv.exe
1560	spoolsv.exe
3936	spoolsv.exe
4332	spoolsv.exe
4624	spoolsv.exe
4292	spoolsv.exe
3164	spoolsv.exe
4288	spoolsv.exe
1440	spoolsv.exe
1644	spoolsv.exe
3004	spoolsv.exe
2540	spoolsv.exe
1340	spoolsv.exe
1812	spoolsv.exe
3768	explorer.exe
3664	spoolsv.exe
5404	spoolsv.exe
5476	spoolsv.exe
5556	spoolsv.exe
5628	spoolsv.exe
5132	spoolsv.exe
5224	spoolsv.exe
5304	explorer.exe
5376	spoolsv.exe
5452	spoolsv.exe
1684	spoolsv.exe
5852	spoolsv.exe
5156	spoolsv.exe
548	explorer.exe
5212	spoolsv.exe
5280	spoolsv.exe
5560	spoolsv.exe
5844	spoolsv.exe
5864	explorer.exe
5984	spoolsv.exe
4328	spoolsv.exe
5428	spoolsv.exe
2484	spoolsv.exe
5780	explorer.exe
5672	spoolsv.exe
5748	spoolsv.exe
6040	spoolsv.exe
6100	spoolsv.exe
5492	spoolsv.exe
5584	explorer.exe
1640	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 632 set thread context of 4072	632	explorer.exe	105
PID 1072 set thread context of 1812	1072	spoolsv.exe	135
PID 5084 set thread context of 3664	5084	spoolsv.exe	137
PID 3296 set thread context of 5476	3296	spoolsv.exe	139
PID 396 set thread context of 5556	396	spoolsv.exe	140
PID 688 set thread context of 5628	688	spoolsv.exe	141
PID 4372 set thread context of 5224	4372	spoolsv.exe	143
PID 1084 set thread context of 5376	1084	spoolsv.exe	145
PID 2804 set thread context of 5452	2804	spoolsv.exe	146
PID 3068 set thread context of 5852	3068	spoolsv.exe	148
PID 1388 set thread context of 5156	1388	spoolsv.exe	149
PID 3380 set thread context of 5212	3380	spoolsv.exe	151
PID 1448 set thread context of 5280	1448	spoolsv.exe	152
PID 3772 set thread context of 5844	3772	spoolsv.exe	154
PID 4436 set thread context of 5984	4436	spoolsv.exe	156
PID 2724 set thread context of 5428	2724	spoolsv.exe	158
PID 3456 set thread context of 2484	3456	spoolsv.exe	159
PID 1076 set thread context of 5672	1076	spoolsv.exe	161
PID 1560 set thread context of 5748	1560	spoolsv.exe	162
PID 3936 set thread context of 6100	3936	spoolsv.exe	164
PID 4332 set thread context of 5492	4332	spoolsv.exe	165
PID 4624 set thread context of 1640	4624	spoolsv.exe	167
PID 4292 set thread context of 5580	4292	spoolsv.exe	168
PID 3164 set thread context of 3212	3164	spoolsv.exe	169
PID 4288 set thread context of 6032	4288	spoolsv.exe	171
PID 1440 set thread context of 6084	1440	spoolsv.exe	172
PID 1644 set thread context of 5484	1644	spoolsv.exe	173
PID 3004 set thread context of 3256	3004	spoolsv.exe	175
PID 2540 set thread context of 4508	2540	spoolsv.exe	177
PID 1340 set thread context of 5440	1340	spoolsv.exe	179
PID 3768 set thread context of 4572	3768	explorer.exe	183
PID 5404 set thread context of 2976	5404	spoolsv.exe	184
PID 5132 set thread context of 5752	5132	spoolsv.exe	188
PID 5304 set thread context of 3444	5304	explorer.exe	190
PID 1684 set thread context of 6128	1684	spoolsv.exe	192
PID 548 set thread context of 1288	548	explorer.exe	194
PID 5560 set thread context of 1396	5560	spoolsv.exe	197
PID 5864 set thread context of 5500	5864	explorer.exe	199
PID 4328 set thread context of 5336	4328	spoolsv.exe	202
PID 5780 set thread context of 4688	5780	explorer.exe	204
PID 6040 set thread context of 5992	6040	spoolsv.exe	208
PID 5584 set thread context of 5272	5584	explorer.exe	211
PID 4080 set thread context of 3216	4080	spoolsv.exe	214
PID 5448 set thread context of 3372	5448	explorer.exe	216
PID 5708 set thread context of 5796	5708	spoolsv.exe	217
PID 3832 set thread context of 4596	3832	spoolsv.exe	219
PID 3252 set thread context of 5884	3252	explorer.exe	221
PID 4552 set thread context of 2120	4552	spoolsv.exe	222
PID 4300 set thread context of 1052	4300	spoolsv.exe	225
PID 6088 set thread context of 5140	6088	explorer.exe	227
PID 4900 set thread context of 1028	4900	spoolsv.exe	228
PID 5732 set thread context of 3064	5732	spoolsv.exe	230
PID 5772 set thread context of 3792	5772	explorer.exe	231
PID 5676 set thread context of 4712	5676	spoolsv.exe	233
PID 4388 set thread context of 1272	4388	explorer.exe	235

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4072	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
4072	explorer.exe
1812	spoolsv.exe
1812	spoolsv.exe
3664	spoolsv.exe
3664	spoolsv.exe
5476	spoolsv.exe
5476	spoolsv.exe
5556	spoolsv.exe
5556	spoolsv.exe
5628	spoolsv.exe
5628	spoolsv.exe
5224	spoolsv.exe
5224	spoolsv.exe
5376	spoolsv.exe
5376	spoolsv.exe
5452	spoolsv.exe
5452	spoolsv.exe
5852	spoolsv.exe
5852	spoolsv.exe
5156	spoolsv.exe
5156	spoolsv.exe
5212	spoolsv.exe
5212	spoolsv.exe
5280	spoolsv.exe
5280	spoolsv.exe
5844	spoolsv.exe
5844	spoolsv.exe
5984	spoolsv.exe
5984	spoolsv.exe
5428	spoolsv.exe
5428	spoolsv.exe
2484	spoolsv.exe
2484	spoolsv.exe
5672	spoolsv.exe
5672	spoolsv.exe
5748	spoolsv.exe
5748	spoolsv.exe
6100	spoolsv.exe
6100	spoolsv.exe
5492	spoolsv.exe
5492	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
5580	spoolsv.exe
5580	spoolsv.exe
3212	spoolsv.exe
3212	spoolsv.exe
6032	spoolsv.exe
6032	spoolsv.exe
6084	spoolsv.exe
6084	spoolsv.exe
5484	spoolsv.exe
5484	spoolsv.exe
3256	spoolsv.exe
3256	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
5440	spoolsv.exe
5440	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2908	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	89
PID 4940 wrote to memory of 2908	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	89
PID 4940 wrote to memory of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 4940 wrote to memory of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 4940 wrote to memory of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 4940 wrote to memory of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 4940 wrote to memory of 3060	4940	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	96
PID 3060 wrote to memory of 632	3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	97
PID 3060 wrote to memory of 632	3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	97
PID 3060 wrote to memory of 632	3060	a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe	97
PID 632 wrote to memory of 4072	632	explorer.exe	105
PID 632 wrote to memory of 4072	632	explorer.exe	105
PID 632 wrote to memory of 4072	632	explorer.exe	105
PID 632 wrote to memory of 4072	632	explorer.exe	105
PID 632 wrote to memory of 4072	632	explorer.exe	105
PID 4072 wrote to memory of 1072	4072	explorer.exe	106
PID 4072 wrote to memory of 1072	4072	explorer.exe	106
PID 4072 wrote to memory of 1072	4072	explorer.exe	106
PID 4072 wrote to memory of 5084	4072	explorer.exe	107
PID 4072 wrote to memory of 5084	4072	explorer.exe	107
PID 4072 wrote to memory of 5084	4072	explorer.exe	107
PID 4072 wrote to memory of 3296	4072	explorer.exe	108
PID 4072 wrote to memory of 3296	4072	explorer.exe	108
PID 4072 wrote to memory of 3296	4072	explorer.exe	108
PID 4072 wrote to memory of 396	4072	explorer.exe	109
PID 4072 wrote to memory of 396	4072	explorer.exe	109
PID 4072 wrote to memory of 396	4072	explorer.exe	109
PID 4072 wrote to memory of 688	4072	explorer.exe	110
PID 4072 wrote to memory of 688	4072	explorer.exe	110
PID 4072 wrote to memory of 688	4072	explorer.exe	110
PID 4072 wrote to memory of 4372	4072	explorer.exe	111
PID 4072 wrote to memory of 4372	4072	explorer.exe	111
PID 4072 wrote to memory of 4372	4072	explorer.exe	111
PID 4072 wrote to memory of 1084	4072	explorer.exe	112
PID 4072 wrote to memory of 1084	4072	explorer.exe	112
PID 4072 wrote to memory of 1084	4072	explorer.exe	112
PID 4072 wrote to memory of 2804	4072	explorer.exe	113
PID 4072 wrote to memory of 2804	4072	explorer.exe	113
PID 4072 wrote to memory of 2804	4072	explorer.exe	113
PID 4072 wrote to memory of 3068	4072	explorer.exe	114
PID 4072 wrote to memory of 3068	4072	explorer.exe	114
PID 4072 wrote to memory of 3068	4072	explorer.exe	114
PID 4072 wrote to memory of 1388	4072	explorer.exe	115
PID 4072 wrote to memory of 1388	4072	explorer.exe	115
PID 4072 wrote to memory of 1388	4072	explorer.exe	115
PID 4072 wrote to memory of 3380	4072	explorer.exe	116
PID 4072 wrote to memory of 3380	4072	explorer.exe	116
PID 4072 wrote to memory of 3380	4072	explorer.exe	116
PID 4072 wrote to memory of 1448	4072	explorer.exe	117
PID 4072 wrote to memory of 1448	4072	explorer.exe	117
PID 4072 wrote to memory of 1448	4072	explorer.exe	117
PID 4072 wrote to memory of 3772	4072	explorer.exe	118
PID 4072 wrote to memory of 3772	4072	explorer.exe	118
PID 4072 wrote to memory of 3772	4072	explorer.exe	118
PID 4072 wrote to memory of 4436	4072	explorer.exe	119
PID 4072 wrote to memory of 4436	4072	explorer.exe	119
PID 4072 wrote to memory of 4436	4072	explorer.exe	119
PID 4072 wrote to memory of 2724	4072	explorer.exe	120
PID 4072 wrote to memory of 2724	4072	explorer.exe	120
PID 4072 wrote to memory of 2724	4072	explorer.exe	120
PID 4072 wrote to memory of 3456	4072	explorer.exe	121
PID 4072 wrote to memory of 3456	4072	explorer.exe	121
PID 4072 wrote to memory of 3456	4072	explorer.exe	121
PID 4072 wrote to memory of 1076	4072	explorer.exe	122

C:\Users\Admin\AppData\Local\Temp\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4a8b1c8948019c40555bebda1f1aa8a_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3060
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:632
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3768
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5304
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:548
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5864
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5780
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5492
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5584
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3252
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6088
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5752
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5772
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6128
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3216
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:5708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4596
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3760,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 ecd52ddd7ed9dda1b8a730118209f01c7989e32a3e5be8c77a7123d23b546bc0
MD5 cc5d612c1bbbfde20679649c489f715a
SHA1 672b222bc79580dba249d1bc1f2e1cc33b70b311
SHA512 7abdba6b6fab6f7b2c263347c30c24cefd479150a569d13a55a5e3915f4cc4c365abf431ed0f5890086f6ca9f79c696cc413eaf42fa23c5936476ca0884c2ba4
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 cc0fe967d7cf5c8d98699927f8343eb556e52335dc51287c620a17f0e4ab23f8
MD5 8a87e91fc4927187d40664427771de7b
SHA1 917c267d0483b2b47527c168b594ace242163d4a
SHA512 58658588cac6b0ffacc41ffa8ff408e93b1f757241d7ae08fa2f812a62f83150f79969c549aa0b477f5cf7e06e433b8c0f56966189693d82ca1065fd4d628dcd
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWww1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/396-938-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/632-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/632-55-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/688-1124-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1028-5179-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-5306-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-5160-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1072-815-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1072-1905-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1076-1813-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1084-1276-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1272-5413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-3851-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-1466-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1396-4140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-4068-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-1468-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1560-1908-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1812-2090-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1812-1910-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-4965-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2484-2722-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2484-2894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2724-1811-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2804-1277-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2976-3536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2976-3634-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-19-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-42-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3060-21-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3064-5249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3064-5253-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-1303-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3212-2937-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-4792-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-4925-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3256-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3296-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3296-937-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3372-4803-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3380-1467-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3444-3727-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-3730-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3456-1812-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3664-1919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-1632-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3792-5330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3936-1909-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4072-814-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4072-59-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4292-2011-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4332-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4372-1125-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4436-1633-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4508-3200-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-3527-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4596-5073-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4596-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4624-2002-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4688-4249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/4940-22-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4940-18-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/4940-16-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5084-1920-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5084-936-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5140-5171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5156-2391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5156-2528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5212-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5212-2402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5224-2372-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5272-4641-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5336-4238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5376-2202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5428-2655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5440-3429-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5440-3351-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5452-2211-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5476-2003-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5484-3116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5492-2912-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5492-3098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5500-4078-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5556-2013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5556-2015-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5580-2927-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5628-2024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5672-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5748-2746-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5748-2743-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5752-3718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5796-4812-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-2547-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-2695-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5852-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5884-4956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5984-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5992-4491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5992-4611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6032-3020-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6084-3029-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6100-2831-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6128-3841-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6128-3969-0x0000000000400000-0x000000000043E000-memory.dmp

Download