pony | 1186c0f8a25acb0d1cdb1d690ba59e02bad9c9f22d9a986a88116bd27b188e55

Analysis

max time kernel
148s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
Size 2.2MB
Sample240613-m2967swblc
SHA256 1186c0f8a25acb0d1cdb1d690ba59e02bad9c9f22d9a986a88116bd27b188e55
MD5 a52f90b246a60e5a7a2e085be681d64d
SHA1 da1c208165cdd9d1cea55b88ddb44ae5aa76fce5
SHA512 ad88ccadc99f6fc46af8f9a739b3257082b56f4ae61ffb8f18d3e05792f033f9f3b65ad28a78aaef479909de2552f61b1120824a3451e3b47ba9a5721f8a94f8
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	explorer.exe
1772	explorer.exe
3776	spoolsv.exe
3924	spoolsv.exe
3848	spoolsv.exe
2300	spoolsv.exe
5040	spoolsv.exe
2964	spoolsv.exe
4832	spoolsv.exe
1076	spoolsv.exe
4472	spoolsv.exe
4728	spoolsv.exe
4352	spoolsv.exe
884	spoolsv.exe
3352	spoolsv.exe
2280	spoolsv.exe
3092	spoolsv.exe
1180	spoolsv.exe
1224	spoolsv.exe
5092	spoolsv.exe
4400	spoolsv.exe
3228	spoolsv.exe
2952	spoolsv.exe
4228	spoolsv.exe
4972	spoolsv.exe
4512	spoolsv.exe
5068	spoolsv.exe
4372	spoolsv.exe
3948	spoolsv.exe
4092	spoolsv.exe
2212	spoolsv.exe
3248	spoolsv.exe
2680	spoolsv.exe
4628	spoolsv.exe
836	explorer.exe
916	spoolsv.exe
5004	spoolsv.exe
4488	spoolsv.exe
4748	spoolsv.exe
3572	spoolsv.exe
2224	explorer.exe
4600	spoolsv.exe
3560	spoolsv.exe
912	spoolsv.exe
4224	spoolsv.exe
2636	explorer.exe
4844	spoolsv.exe
3272	spoolsv.exe
2600	spoolsv.exe
2352	spoolsv.exe
452	explorer.exe
1496	spoolsv.exe
4700	spoolsv.exe
1096	spoolsv.exe
1992	spoolsv.exe
2276	spoolsv.exe
456	explorer.exe
1396	spoolsv.exe
4908	spoolsv.exe
1540	spoolsv.exe
4572	spoolsv.exe
4952	spoolsv.exe
2776	spoolsv.exe
2220	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 2332 set thread context of 1772	2332	explorer.exe	96
PID 3776 set thread context of 4628	3776	spoolsv.exe	128
PID 3924 set thread context of 916	3924	spoolsv.exe	130
PID 3848 set thread context of 5004	3848	spoolsv.exe	131
PID 2300 set thread context of 4748	2300	spoolsv.exe	133
PID 5040 set thread context of 3572	5040	spoolsv.exe	134
PID 2964 set thread context of 4600	2964	spoolsv.exe	136
PID 4832 set thread context of 3560	4832	spoolsv.exe	137
PID 1076 set thread context of 4224	1076	spoolsv.exe	139
PID 4472 set thread context of 4844	4472	spoolsv.exe	141
PID 4728 set thread context of 3272	4728	spoolsv.exe	142
PID 4352 set thread context of 2352	4352	spoolsv.exe	144
PID 884 set thread context of 1496	884	spoolsv.exe	146
PID 3352 set thread context of 4700	3352	spoolsv.exe	163
PID 2280 set thread context of 1096	2280	spoolsv.exe	148
PID 3092 set thread context of 2276	3092	spoolsv.exe	150
PID 1180 set thread context of 1396	1180	spoolsv.exe	152
PID 1224 set thread context of 4908	1224	spoolsv.exe	153
PID 5092 set thread context of 4572	5092	spoolsv.exe	155
PID 4400 set thread context of 4952	4400	spoolsv.exe	156
PID 3228 set thread context of 2776	3228	spoolsv.exe	157
PID 2952 set thread context of 4592	2952	spoolsv.exe	159
PID 4228 set thread context of 2872	4228	spoolsv.exe	161
PID 4972 set thread context of 4016	4972	spoolsv.exe	162
PID 4512 set thread context of 4700	4512	spoolsv.exe	163
PID 5068 set thread context of 440	5068	spoolsv.exe	164
PID 4372 set thread context of 2892	4372	spoolsv.exe	166
PID 3948 set thread context of 3052	3948	spoolsv.exe	168
PID 4092 set thread context of 1892	4092	spoolsv.exe	169
PID 2212 set thread context of 1092	2212	spoolsv.exe	170
PID 3248 set thread context of 704	3248	spoolsv.exe	172
PID 2680 set thread context of 3036	2680	spoolsv.exe	174
PID 836 set thread context of 4880	836	explorer.exe	177
PID 4488 set thread context of 1868	4488	spoolsv.exe	179
PID 2224 set thread context of 4712	2224	explorer.exe	181
PID 912 set thread context of 1352	912	spoolsv.exe	184
PID 2636 set thread context of 2676	2636	explorer.exe	186
PID 452 set thread context of 680	452	explorer.exe	189
PID 2600 set thread context of 5064	2600	spoolsv.exe	190
PID 1992 set thread context of 3832	1992	spoolsv.exe	194
PID 456 set thread context of 3024	456	explorer.exe	197
PID 1540 set thread context of 3016	1540	spoolsv.exe	200
PID 2220 set thread context of 1532	2220	explorer.exe	203
PID 5048 set thread context of 1436	5048	spoolsv.exe	205
PID 2760 set thread context of 3892	2760	spoolsv.exe	209
PID 4384 set thread context of 2980	4384	explorer.exe	211
PID 4624 set thread context of 2228	4624	spoolsv.exe	212
PID 4056 set thread context of 4120	4056	spoolsv.exe	214
PID 1272 set thread context of 4984	1272	spoolsv.exe	217
PID 1764 set thread context of 2756	1764	explorer.exe	218
PID 2904 set thread context of 4456	2904	spoolsv.exe	220
PID 3340 set thread context of 4968	3340	explorer.exe	222
PID 2016 set thread context of 4996	2016	spoolsv.exe	223
PID 116 set thread context of 2856	116	spoolsv.exe	225
PID 2188 set thread context of 4724	2188	explorer.exe	226

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1772	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
1772	explorer.exe
4628	spoolsv.exe
4628	spoolsv.exe
916	spoolsv.exe
916	spoolsv.exe
5004	spoolsv.exe
5004	spoolsv.exe
4748	spoolsv.exe
4748	spoolsv.exe
3572	spoolsv.exe
3572	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe
3560	spoolsv.exe
3560	spoolsv.exe
4224	spoolsv.exe
4224	spoolsv.exe
4844	spoolsv.exe
4844	spoolsv.exe
3272	spoolsv.exe
3272	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
1096	spoolsv.exe
1096	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
1396	spoolsv.exe
1396	spoolsv.exe
4908	spoolsv.exe
4908	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
4952	spoolsv.exe
4952	spoolsv.exe
2776	spoolsv.exe
2776	spoolsv.exe
4592	spoolsv.exe
4592	spoolsv.exe
2872	spoolsv.exe
2872	spoolsv.exe
4016	spoolsv.exe
4016	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
440	spoolsv.exe
440	spoolsv.exe
2892	spoolsv.exe
2892	spoolsv.exe
3052	spoolsv.exe
3052	spoolsv.exe
1892	spoolsv.exe
1892	spoolsv.exe
1092	spoolsv.exe
1092	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3912	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	82
PID 5064 wrote to memory of 3912	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	82
PID 5064 wrote to memory of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 5064 wrote to memory of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 5064 wrote to memory of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 5064 wrote to memory of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 5064 wrote to memory of 4500	5064	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	87
PID 4500 wrote to memory of 2332	4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	88
PID 4500 wrote to memory of 2332	4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	88
PID 4500 wrote to memory of 2332	4500	a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe	88
PID 2332 wrote to memory of 1772	2332	explorer.exe	96
PID 2332 wrote to memory of 1772	2332	explorer.exe	96
PID 2332 wrote to memory of 1772	2332	explorer.exe	96
PID 2332 wrote to memory of 1772	2332	explorer.exe	96
PID 2332 wrote to memory of 1772	2332	explorer.exe	96
PID 1772 wrote to memory of 3776	1772	explorer.exe	97
PID 1772 wrote to memory of 3776	1772	explorer.exe	97
PID 1772 wrote to memory of 3776	1772	explorer.exe	97
PID 1772 wrote to memory of 3924	1772	explorer.exe	98
PID 1772 wrote to memory of 3924	1772	explorer.exe	98
PID 1772 wrote to memory of 3924	1772	explorer.exe	98
PID 1772 wrote to memory of 3848	1772	explorer.exe	99
PID 1772 wrote to memory of 3848	1772	explorer.exe	99
PID 1772 wrote to memory of 3848	1772	explorer.exe	99
PID 1772 wrote to memory of 2300	1772	explorer.exe	100
PID 1772 wrote to memory of 2300	1772	explorer.exe	100
PID 1772 wrote to memory of 2300	1772	explorer.exe	100
PID 1772 wrote to memory of 5040	1772	explorer.exe	101
PID 1772 wrote to memory of 5040	1772	explorer.exe	101
PID 1772 wrote to memory of 5040	1772	explorer.exe	101
PID 1772 wrote to memory of 2964	1772	explorer.exe	102
PID 1772 wrote to memory of 2964	1772	explorer.exe	102
PID 1772 wrote to memory of 2964	1772	explorer.exe	102
PID 1772 wrote to memory of 4832	1772	explorer.exe	103
PID 1772 wrote to memory of 4832	1772	explorer.exe	103
PID 1772 wrote to memory of 4832	1772	explorer.exe	103
PID 1772 wrote to memory of 1076	1772	explorer.exe	104
PID 1772 wrote to memory of 1076	1772	explorer.exe	104
PID 1772 wrote to memory of 1076	1772	explorer.exe	104
PID 1772 wrote to memory of 4472	1772	explorer.exe	105
PID 1772 wrote to memory of 4472	1772	explorer.exe	105
PID 1772 wrote to memory of 4472	1772	explorer.exe	105
PID 1772 wrote to memory of 4728	1772	explorer.exe	106
PID 1772 wrote to memory of 4728	1772	explorer.exe	106
PID 1772 wrote to memory of 4728	1772	explorer.exe	106
PID 1772 wrote to memory of 4352	1772	explorer.exe	107
PID 1772 wrote to memory of 4352	1772	explorer.exe	107
PID 1772 wrote to memory of 4352	1772	explorer.exe	107
PID 1772 wrote to memory of 884	1772	explorer.exe	108
PID 1772 wrote to memory of 884	1772	explorer.exe	108
PID 1772 wrote to memory of 884	1772	explorer.exe	108
PID 1772 wrote to memory of 3352	1772	explorer.exe	109
PID 1772 wrote to memory of 3352	1772	explorer.exe	109
PID 1772 wrote to memory of 3352	1772	explorer.exe	109
PID 1772 wrote to memory of 2280	1772	explorer.exe	110
PID 1772 wrote to memory of 2280	1772	explorer.exe	110
PID 1772 wrote to memory of 2280	1772	explorer.exe	110
PID 1772 wrote to memory of 3092	1772	explorer.exe	111
PID 1772 wrote to memory of 3092	1772	explorer.exe	111
PID 1772 wrote to memory of 3092	1772	explorer.exe	111
PID 1772 wrote to memory of 1180	1772	explorer.exe	112
PID 1772 wrote to memory of 1180	1772	explorer.exe	112
PID 1772 wrote to memory of 1180	1772	explorer.exe	112
PID 1772 wrote to memory of 1224	1772	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a52f90b246a60e5a7a2e085be681d64d_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4500
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:836
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2636
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2220
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1764
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3340
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2188
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3832
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3016
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:768
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 8f7eb43be6f4d904ee3071033ad97507c9c1158e0190904e55b08af5b095dda4
MD5 96592cb270d8cb57b0537511d00bdc15
SHA1 b524506217166f5945f3a8a25dbaae80c775c5ab
SHA512 9601d241961926e9b63ac9540538e0b4fce9860f3cd576e0226c7771c828a5ba54408c71462b80dae6ed9aaa402cf7fedcf9b067939a7b156ec50790195ead33
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 59525778dda1f8cbf69480fd231c39019a1a9a85fe91bc319df3f16502b41f49
MD5 1ef833f20439deaa03e4b83afc9649ef
SHA1 1bfa6eadafd2fab6ce75ba8582f0df7656e061dd
SHA512 e5123532868fa216a2bd8533e6effa5a67e4fa0fbf95a819e7d3b005a31153d89af301764890205cb5ba1f52cfba2879e1d834954607d5bd8b5373e1b030d591
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZx:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-2975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/680-3784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/704-3215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/768-5091-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/884-1559-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/916-2029-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1076-1388-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1092-3072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1096-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1180-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1224-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1352-3633-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-2640-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1396-2637-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-4462-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1532-4393-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-840-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-95-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1868-3535-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1868-3431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1892-3060-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2228-4574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2228-4571-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2276-2629-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2276-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2280-1729-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2300-2118-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2300-1009-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2332-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2332-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2352-2561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2352-2508-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2676-3642-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2756-4779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-2807-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-2973-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-3212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-3041-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2952-2031-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2964-1206-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2980-4562-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3024-4124-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3036-3418-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3036-3295-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-3049-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-3053-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3092-1730-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3228-2019-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3272-2377-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3352-1728-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3560-2233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-2324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-2199-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3776-2020-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3776-841-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3848-1008-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3848-2068-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3892-4554-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3892-4682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-2032-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3924-1007-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4120-4703-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4120-4832-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4224-2358-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4224-2486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4228-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4352-1558-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4400-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4456-4909-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-1389-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4500-31-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-79-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-29-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2724-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4600-2208-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-2191-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-2022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4700-2526-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-3462-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4724-5027-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4728-1557-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4748-2116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-2117-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4832-1387-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4844-2368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-3354-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4908-2648-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-2734-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-4917-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2115-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4984-4768-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5004-2049-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-1205-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5064-3875-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-28-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/5064-0-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/5064-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5064-3790-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5092-1860-0x0000000000400000-0x00000000005D3000-memory.dmp

Download