pony | 0ded7a3e8451dcd89149a054aa3d522979eccff8685eab141a48022769a9ac51

Analysis

max time kernel
148s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
Size 2.2MB
Sample240613-ktdrxswank
SHA256 0ded7a3e8451dcd89149a054aa3d522979eccff8685eab141a48022769a9ac51
MD5 a4b7c803cd1ce9f2a56962a9efbb8616
SHA1 1fdf875088d18fe252604ade10a5cae993d12478
SHA512 780284dde0abe486ff662e0b6abda279825e861fc1fecb9fc6db8576b2f05564dbdbea535749efe2efa04efbde1e81d98b7ae5c82e69f8e3c477e52fc7e9e635
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWww4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
5008	explorer.exe
1164	explorer.exe
5068	spoolsv.exe
4108	spoolsv.exe
4292	spoolsv.exe
3484	spoolsv.exe
2172	spoolsv.exe
32	spoolsv.exe
3044	spoolsv.exe
2792	spoolsv.exe
5004	spoolsv.exe
1916	spoolsv.exe
4084	spoolsv.exe
1604	spoolsv.exe
1396	spoolsv.exe
3564	spoolsv.exe
1224	spoolsv.exe
3548	spoolsv.exe
2952	spoolsv.exe
1300	spoolsv.exe
416	spoolsv.exe
2316	spoolsv.exe
3128	spoolsv.exe
1492	spoolsv.exe
5096	spoolsv.exe
3752	spoolsv.exe
1540	spoolsv.exe
3196	spoolsv.exe
964	spoolsv.exe
2388	spoolsv.exe
4448	spoolsv.exe
368	spoolsv.exe
2108	spoolsv.exe
624	spoolsv.exe
4928	spoolsv.exe
4540	spoolsv.exe
2424	explorer.exe
3672	spoolsv.exe
2844	spoolsv.exe
4844	spoolsv.exe
4960	spoolsv.exe
1064	spoolsv.exe
1580	spoolsv.exe
4784	explorer.exe
1600	spoolsv.exe
1020	spoolsv.exe
4332	spoolsv.exe
5060	spoolsv.exe
428	explorer.exe
2704	spoolsv.exe
1988	spoolsv.exe
3648	spoolsv.exe
1920	spoolsv.exe
3292	spoolsv.exe
2972	spoolsv.exe
4632	spoolsv.exe
4532	spoolsv.exe
5040	explorer.exe
5052	spoolsv.exe
4584	spoolsv.exe
4412	spoolsv.exe
956	spoolsv.exe
4092	spoolsv.exe
1288	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 208 set thread context of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 5008 set thread context of 1164	5008	explorer.exe	94
PID 5068 set thread context of 4540	5068	spoolsv.exe	128
PID 4108 set thread context of 3672	4108	spoolsv.exe	130
PID 4292 set thread context of 2844	4292	spoolsv.exe	131
PID 3484 set thread context of 4844	3484	spoolsv.exe	132
PID 2172 set thread context of 1064	2172	spoolsv.exe	134
PID 32 set thread context of 1580	32	spoolsv.exe	135
PID 3044 set thread context of 1600	3044	spoolsv.exe	137
PID 2792 set thread context of 4332	2792	spoolsv.exe	139
PID 5004 set thread context of 5060	5004	spoolsv.exe	140
PID 1916 set thread context of 2704	1916	spoolsv.exe	142
PID 4084 set thread context of 1988	4084	spoolsv.exe	143
PID 1604 set thread context of 3648	1604	spoolsv.exe	144
PID 1396 set thread context of 1920	1396	spoolsv.exe	145
PID 3564 set thread context of 2972	3564	spoolsv.exe	147
PID 1224 set thread context of 4632	1224	spoolsv.exe	148
PID 3548 set thread context of 4532	3548	spoolsv.exe	149
PID 2952 set thread context of 5052	2952	spoolsv.exe	151
PID 1300 set thread context of 4584	1300	spoolsv.exe	152
PID 416 set thread context of 4412	416	spoolsv.exe	153
PID 2316 set thread context of 956	2316	spoolsv.exe	154
PID 3128 set thread context of 1288	3128	spoolsv.exe	156
PID 1492 set thread context of 3236	1492	spoolsv.exe	158
PID 5096 set thread context of 3832	5096	spoolsv.exe	159
PID 3752 set thread context of 872	3752	spoolsv.exe	160
PID 1540 set thread context of 2604	1540	spoolsv.exe	161
PID 3196 set thread context of 4160	3196	spoolsv.exe	163
PID 964 set thread context of 3244	964	spoolsv.exe	164
PID 2388 set thread context of 3572	2388	spoolsv.exe	166
PID 4448 set thread context of 1220	4448	spoolsv.exe	167
PID 368 set thread context of 4552	368	spoolsv.exe	168
PID 2108 set thread context of 1700	2108	spoolsv.exe	170
PID 624 set thread context of 2248	624	spoolsv.exe	172
PID 4928 set thread context of 4488	4928	spoolsv.exe	176
PID 2424 set thread context of 60	2424	explorer.exe	178
PID 4960 set thread context of 1052	4960	spoolsv.exe	180
PID 4784 set thread context of 4780	4784	explorer.exe	183
PID 1020 set thread context of 4116	1020	spoolsv.exe	187
PID 428 set thread context of 1832	428	explorer.exe	190
PID 3292 set thread context of 3644	3292	spoolsv.exe	195
PID 5040 set thread context of 1840	5040	explorer.exe	198
PID 4092 set thread context of 4280	4092	spoolsv.exe	202
PID 3364 set thread context of 1212	3364	explorer.exe	205
PID 2616 set thread context of 1256	2616	spoolsv.exe	209
PID 2964 set thread context of 2268	2964	explorer.exe	211
PID 2428 set thread context of 1608	2428	spoolsv.exe	212
PID 384 set thread context of 2272	384	explorer.exe	213
PID 3784 set thread context of 1860	3784	spoolsv.exe	214
PID 1372 set thread context of 2000	1372	spoolsv.exe	217
PID 5016 set thread context of 2756	5016	spoolsv.exe	219
PID 4900 set thread context of 3444	4900	explorer.exe	221
PID 4744 set thread context of 1308	4744	spoolsv.exe	223
PID 1592 set thread context of 3188	1592	explorer.exe	225
PID 1032 set thread context of 388	1032	spoolsv.exe	226
PID 2640 set thread context of 4424	2640	spoolsv.exe	228
PID 2708 set thread context of 4360	2708	spoolsv.exe	229

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1164	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
4540	spoolsv.exe
4540	spoolsv.exe
3672	spoolsv.exe
3672	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
4844	spoolsv.exe
4844	spoolsv.exe
1064	spoolsv.exe
1064	spoolsv.exe
1580	spoolsv.exe
1580	spoolsv.exe
1600	spoolsv.exe
1600	spoolsv.exe
4332	spoolsv.exe
4332	spoolsv.exe
5060	spoolsv.exe
5060	spoolsv.exe
2704	spoolsv.exe
2704	spoolsv.exe
1988	spoolsv.exe
1988	spoolsv.exe
3648	spoolsv.exe
3648	spoolsv.exe
1920	spoolsv.exe
1920	spoolsv.exe
2972	spoolsv.exe
2972	spoolsv.exe
4632	spoolsv.exe
4632	spoolsv.exe
4532	spoolsv.exe
4532	spoolsv.exe
5052	spoolsv.exe
5052	spoolsv.exe
4584	spoolsv.exe
4584	spoolsv.exe
4412	spoolsv.exe
4412	spoolsv.exe
956	spoolsv.exe
956	spoolsv.exe
1288	spoolsv.exe
1288	spoolsv.exe
3236	spoolsv.exe
3236	spoolsv.exe
3832	spoolsv.exe
3832	spoolsv.exe
872	spoolsv.exe
872	spoolsv.exe
2604	spoolsv.exe
2604	spoolsv.exe
4160	spoolsv.exe
4160	spoolsv.exe
3244	spoolsv.exe
3244	spoolsv.exe
3572	spoolsv.exe
3572	spoolsv.exe
1220	spoolsv.exe
1220	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2672	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	82
PID 208 wrote to memory of 2672	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	82
PID 208 wrote to memory of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 208 wrote to memory of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 208 wrote to memory of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 208 wrote to memory of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 208 wrote to memory of 4044	208	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	89
PID 4044 wrote to memory of 5008	4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	90
PID 4044 wrote to memory of 5008	4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	90
PID 4044 wrote to memory of 5008	4044	a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe	90
PID 5008 wrote to memory of 1164	5008	explorer.exe	94
PID 5008 wrote to memory of 1164	5008	explorer.exe	94
PID 5008 wrote to memory of 1164	5008	explorer.exe	94
PID 5008 wrote to memory of 1164	5008	explorer.exe	94
PID 5008 wrote to memory of 1164	5008	explorer.exe	94
PID 1164 wrote to memory of 5068	1164	explorer.exe	95
PID 1164 wrote to memory of 5068	1164	explorer.exe	95
PID 1164 wrote to memory of 5068	1164	explorer.exe	95
PID 1164 wrote to memory of 4108	1164	explorer.exe	96
PID 1164 wrote to memory of 4108	1164	explorer.exe	96
PID 1164 wrote to memory of 4108	1164	explorer.exe	96
PID 1164 wrote to memory of 4292	1164	explorer.exe	97
PID 1164 wrote to memory of 4292	1164	explorer.exe	97
PID 1164 wrote to memory of 4292	1164	explorer.exe	97
PID 1164 wrote to memory of 3484	1164	explorer.exe	98
PID 1164 wrote to memory of 3484	1164	explorer.exe	98
PID 1164 wrote to memory of 3484	1164	explorer.exe	98
PID 1164 wrote to memory of 2172	1164	explorer.exe	99
PID 1164 wrote to memory of 2172	1164	explorer.exe	99
PID 1164 wrote to memory of 2172	1164	explorer.exe	99
PID 1164 wrote to memory of 32	1164	explorer.exe	100
PID 1164 wrote to memory of 32	1164	explorer.exe	100
PID 1164 wrote to memory of 32	1164	explorer.exe	100
PID 1164 wrote to memory of 3044	1164	explorer.exe	101
PID 1164 wrote to memory of 3044	1164	explorer.exe	101
PID 1164 wrote to memory of 3044	1164	explorer.exe	101
PID 1164 wrote to memory of 2792	1164	explorer.exe	102
PID 1164 wrote to memory of 2792	1164	explorer.exe	102
PID 1164 wrote to memory of 2792	1164	explorer.exe	102
PID 1164 wrote to memory of 5004	1164	explorer.exe	103
PID 1164 wrote to memory of 5004	1164	explorer.exe	103
PID 1164 wrote to memory of 5004	1164	explorer.exe	103
PID 1164 wrote to memory of 1916	1164	explorer.exe	104
PID 1164 wrote to memory of 1916	1164	explorer.exe	104
PID 1164 wrote to memory of 1916	1164	explorer.exe	104
PID 1164 wrote to memory of 4084	1164	explorer.exe	105
PID 1164 wrote to memory of 4084	1164	explorer.exe	105
PID 1164 wrote to memory of 4084	1164	explorer.exe	105
PID 1164 wrote to memory of 1604	1164	explorer.exe	106
PID 1164 wrote to memory of 1604	1164	explorer.exe	106
PID 1164 wrote to memory of 1604	1164	explorer.exe	106
PID 1164 wrote to memory of 1396	1164	explorer.exe	107
PID 1164 wrote to memory of 1396	1164	explorer.exe	107
PID 1164 wrote to memory of 1396	1164	explorer.exe	107
PID 1164 wrote to memory of 3564	1164	explorer.exe	108
PID 1164 wrote to memory of 3564	1164	explorer.exe	108
PID 1164 wrote to memory of 3564	1164	explorer.exe	108
PID 1164 wrote to memory of 1224	1164	explorer.exe	109
PID 1164 wrote to memory of 1224	1164	explorer.exe	109
PID 1164 wrote to memory of 1224	1164	explorer.exe	109
PID 1164 wrote to memory of 3548	1164	explorer.exe	110
PID 1164 wrote to memory of 3548	1164	explorer.exe	110
PID 1164 wrote to memory of 3548	1164	explorer.exe	110
PID 1164 wrote to memory of 2952	1164	explorer.exe	111

C:\Users\Admin\AppData\Local\Temp\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4b7c803cd1ce9f2a56962a9efbb8616_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4044
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2424
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:32
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4784
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:428
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3364
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2964
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4900
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4116
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4280
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1256
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 a71a5e5c8ad9d92dd9eb9d4806a0fe03068d9b44a4b5f9c1f53f5b69ef044706
MD5 00db94bc129ce7b5abf2ece52360f75f
SHA1 0bb8eb40c29137c5a9878da3a6566cc77704375b
SHA512 8d70133ec7b661894bccbb666d92c8ebdb7d85f46b14ef2a2b7cb357896dffc996164fdca87d42f2a4d494d4b59dd39ace97dddf280975da28c603a42b7a2249
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 96fa08376a85a54cd3ab6d7485e397c57d03e9449936093b1e592dadcb147f45
MD5 b7828114e5698ef6aa86663a2e987c42
SHA1 3c9747ea5b502cb2613f6e734eafe8e5b5008149
SHA512 6000fd1f531ecc0c8e84374c880e4cae604191e9876aa7740a5b574e13dc2554a1662c45d82cd95db8a71593897742382c97ed4c6b0aba42202d86055d63dbb0
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWww7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/32-1305-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/60-3748-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/208-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/208-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/208-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/208-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/388-5825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/416-2268-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/872-3127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/956-2986-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-3954-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-3820-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-925-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1212-5014-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1220-3314-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1224-1904-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1256-5336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1256-5433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-3274-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1288-3088-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1300-2100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1308-5806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-1902-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1492-2279-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1580-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-2614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1600-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1604-1698-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1700-3584-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1832-4310-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1840-4690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1860-5524-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1860-5626-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1916-1509-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1920-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-5545-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-5548-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2172-1304-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2248-3499-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-3502-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2272-5366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-2269-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2604-3137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2756-5647-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2756-5778-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2792-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2844-2292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2952-2099-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2972-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2972-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3044-1306-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3128-2270-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3188-5817-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3236-3107-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3244-3474-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3244-3298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-5653-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-5656-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-1114-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3548-2098-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3564-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3572-3305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-4593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3644-4753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3648-2696-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3672-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3832-3119-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-87-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4084-1697-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4108-2282-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4108-1112-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4116-4161-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4160-3247-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4280-4921-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4280-5077-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4292-2294-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4292-1113-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4332-2573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-2905-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4424-5912-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4488-3739-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4532-2875-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4532-3067-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-2444-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-2271-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4552-3324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4584-2894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-2827-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-3906-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-2303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5004-1508-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5008-106-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5008-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5052-2883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5052-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5060-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-2272-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5068-931-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5096-2291-0x0000000000400000-0x00000000005D3000-memory.dmp

Download