pony | d5b81e9d59d57950d30194bf171e0b9e4c121ca9ae9011d245d4f3be69caac62

Analysis

max time kernel
134s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
Size 2.2MB
Sample240613-qdbkhszene
SHA256 d5b81e9d59d57950d30194bf171e0b9e4c121ca9ae9011d245d4f3be69caac62
MD5 a5b2929a9f0aed16fc5f1273337b8361
SHA1 5755c0e4b7aa12c748281ecf07694d61619a8b0c
SHA512 9ef5b59d8b332af1b88763bd432c5e4ba3ae94c6dfaeba42f31b003022c912ced698d67540f300a81075848767047afd1ad565c24ff78c8915d0514840a6259b
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
212	explorer.exe
4136	explorer.exe
2084	spoolsv.exe
3132	spoolsv.exe
380	spoolsv.exe
2376	spoolsv.exe
2088	spoolsv.exe
808	spoolsv.exe
1676	spoolsv.exe
4668	spoolsv.exe
4272	spoolsv.exe
232	spoolsv.exe
2628	spoolsv.exe
528	spoolsv.exe
1948	spoolsv.exe
1180	spoolsv.exe
2936	spoolsv.exe
5108	spoolsv.exe
4628	spoolsv.exe
4152	spoolsv.exe
4404	spoolsv.exe
4564	spoolsv.exe
4788	spoolsv.exe
652	spoolsv.exe
3996	spoolsv.exe
2140	spoolsv.exe
4576	spoolsv.exe
4416	spoolsv.exe
2916	spoolsv.exe
4904	spoolsv.exe
1776	spoolsv.exe
4556	spoolsv.exe
588	spoolsv.exe
4776	explorer.exe
4652	spoolsv.exe
1496	spoolsv.exe
1128	spoolsv.exe
4976	spoolsv.exe
4540	spoolsv.exe
4444	explorer.exe
3268	spoolsv.exe
1616	spoolsv.exe
1060	spoolsv.exe
3968	spoolsv.exe
4360	spoolsv.exe
3916	explorer.exe
4756	spoolsv.exe
464	spoolsv.exe
2608	spoolsv.exe
932	spoolsv.exe
2600	explorer.exe
4572	spoolsv.exe
1120	spoolsv.exe
5028	spoolsv.exe
2456	spoolsv.exe
4188	spoolsv.exe
1420	explorer.exe
680	spoolsv.exe
2260	spoolsv.exe
4032	spoolsv.exe
4956	spoolsv.exe
4396	spoolsv.exe
1972	spoolsv.exe
1808	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 212 set thread context of 4136	212	explorer.exe	96
PID 2084 set thread context of 588	2084	spoolsv.exe	127
PID 3132 set thread context of 4652	3132	spoolsv.exe	129
PID 380 set thread context of 1496	380	spoolsv.exe	130
PID 2376 set thread context of 1128	2376	spoolsv.exe	131
PID 2088 set thread context of 4540	2088	spoolsv.exe	133
PID 808 set thread context of 3268	808	spoolsv.exe	135
PID 1676 set thread context of 1616	1676	spoolsv.exe	136
PID 4668 set thread context of 1060	4668	spoolsv.exe	137
PID 4272 set thread context of 4360	4272	spoolsv.exe	139
PID 232 set thread context of 4756	232	spoolsv.exe	141
PID 2628 set thread context of 464	2628	spoolsv.exe	142
PID 528 set thread context of 932	528	spoolsv.exe	144
PID 1948 set thread context of 4572	1948	spoolsv.exe	146
PID 1180 set thread context of 1120	1180	spoolsv.exe	147
PID 2936 set thread context of 2456	2936	spoolsv.exe	149
PID 5108 set thread context of 4188	5108	spoolsv.exe	150
PID 4628 set thread context of 680	4628	spoolsv.exe	152
PID 4152 set thread context of 4032	4152	spoolsv.exe	154
PID 4404 set thread context of 4956	4404	spoolsv.exe	155
PID 4564 set thread context of 4396	4564	spoolsv.exe	156
PID 4788 set thread context of 1808	4788	spoolsv.exe	158
PID 652 set thread context of 5080	652	spoolsv.exe	160
PID 3996 set thread context of 1220	3996	spoolsv.exe	161
PID 2140 set thread context of 4364	2140	spoolsv.exe	162
PID 4576 set thread context of 1140	4576	spoolsv.exe	164
PID 4416 set thread context of 4056	4416	spoolsv.exe	166
PID 2916 set thread context of 4012	2916	spoolsv.exe	167
PID 4904 set thread context of 1712	4904	spoolsv.exe	169
PID 1776 set thread context of 2516	1776	spoolsv.exe	170
PID 4556 set thread context of 2440	4556	spoolsv.exe	175
PID 4776 set thread context of 4432	4776	explorer.exe	178
PID 4976 set thread context of 4468	4976	spoolsv.exe	180
PID 4444 set thread context of 2272	4444	explorer.exe	182
PID 3916 set thread context of 620	3916	explorer.exe	185
PID 3968 set thread context of 4376	3968	spoolsv.exe	186
PID 2608 set thread context of 4288	2608	spoolsv.exe	190
PID 2600 set thread context of 1428	2600	explorer.exe	193
PID 5028 set thread context of 1788	5028	spoolsv.exe	195
PID 2260 set thread context of 212	2260	spoolsv.exe	200
PID 1420 set thread context of 4392	1420	explorer.exe	199
PID 1972 set thread context of 716	1972	spoolsv.exe	204
PID 5116 set thread context of 1812	5116	explorer.exe	206

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
4136	explorer.exe
588	spoolsv.exe
588	spoolsv.exe
4652	spoolsv.exe
4652	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
1128	spoolsv.exe
1128	spoolsv.exe
4540	spoolsv.exe
4540	spoolsv.exe
3268	spoolsv.exe
3268	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
1060	spoolsv.exe
1060	spoolsv.exe
4360	spoolsv.exe
4360	spoolsv.exe
4756	spoolsv.exe
4756	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
932	spoolsv.exe
932	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
1120	spoolsv.exe
1120	spoolsv.exe
2456	spoolsv.exe
2456	spoolsv.exe
4188	spoolsv.exe
4188	spoolsv.exe
680	spoolsv.exe
680	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
4956	spoolsv.exe
4956	spoolsv.exe
4396	spoolsv.exe
4396	spoolsv.exe
1808	spoolsv.exe
1808	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
1220	spoolsv.exe
1220	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe
1140	spoolsv.exe
1140	spoolsv.exe
4056	spoolsv.exe
4056	spoolsv.exe
4012	spoolsv.exe
4012	spoolsv.exe
1712	spoolsv.exe
1712	spoolsv.exe
2516	spoolsv.exe
2516	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2228	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	82
PID 4760 wrote to memory of 2228	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	82
PID 4760 wrote to memory of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 4760 wrote to memory of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 4760 wrote to memory of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 4760 wrote to memory of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 4760 wrote to memory of 1704	4760	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	87
PID 1704 wrote to memory of 212	1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	88
PID 1704 wrote to memory of 212	1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	88
PID 1704 wrote to memory of 212	1704	a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe	88
PID 212 wrote to memory of 4136	212	explorer.exe	96
PID 212 wrote to memory of 4136	212	explorer.exe	96
PID 212 wrote to memory of 4136	212	explorer.exe	96
PID 212 wrote to memory of 4136	212	explorer.exe	96
PID 212 wrote to memory of 4136	212	explorer.exe	96
PID 4136 wrote to memory of 2084	4136	explorer.exe	97
PID 4136 wrote to memory of 2084	4136	explorer.exe	97
PID 4136 wrote to memory of 2084	4136	explorer.exe	97
PID 4136 wrote to memory of 3132	4136	explorer.exe	98
PID 4136 wrote to memory of 3132	4136	explorer.exe	98
PID 4136 wrote to memory of 3132	4136	explorer.exe	98
PID 4136 wrote to memory of 380	4136	explorer.exe	99
PID 4136 wrote to memory of 380	4136	explorer.exe	99
PID 4136 wrote to memory of 380	4136	explorer.exe	99
PID 4136 wrote to memory of 2376	4136	explorer.exe	100
PID 4136 wrote to memory of 2376	4136	explorer.exe	100
PID 4136 wrote to memory of 2376	4136	explorer.exe	100
PID 4136 wrote to memory of 2088	4136	explorer.exe	101
PID 4136 wrote to memory of 2088	4136	explorer.exe	101
PID 4136 wrote to memory of 2088	4136	explorer.exe	101
PID 4136 wrote to memory of 808	4136	explorer.exe	102
PID 4136 wrote to memory of 808	4136	explorer.exe	102
PID 4136 wrote to memory of 808	4136	explorer.exe	102
PID 4136 wrote to memory of 1676	4136	explorer.exe	103
PID 4136 wrote to memory of 1676	4136	explorer.exe	103
PID 4136 wrote to memory of 1676	4136	explorer.exe	103
PID 4136 wrote to memory of 4668	4136	explorer.exe	104
PID 4136 wrote to memory of 4668	4136	explorer.exe	104
PID 4136 wrote to memory of 4668	4136	explorer.exe	104
PID 4136 wrote to memory of 4272	4136	explorer.exe	105
PID 4136 wrote to memory of 4272	4136	explorer.exe	105
PID 4136 wrote to memory of 4272	4136	explorer.exe	105
PID 4136 wrote to memory of 232	4136	explorer.exe	106
PID 4136 wrote to memory of 232	4136	explorer.exe	106
PID 4136 wrote to memory of 232	4136	explorer.exe	106
PID 4136 wrote to memory of 2628	4136	explorer.exe	107
PID 4136 wrote to memory of 2628	4136	explorer.exe	107
PID 4136 wrote to memory of 2628	4136	explorer.exe	107
PID 4136 wrote to memory of 528	4136	explorer.exe	108
PID 4136 wrote to memory of 528	4136	explorer.exe	108
PID 4136 wrote to memory of 528	4136	explorer.exe	108
PID 4136 wrote to memory of 1948	4136	explorer.exe	109
PID 4136 wrote to memory of 1948	4136	explorer.exe	109
PID 4136 wrote to memory of 1948	4136	explorer.exe	109
PID 4136 wrote to memory of 1180	4136	explorer.exe	110
PID 4136 wrote to memory of 1180	4136	explorer.exe	110
PID 4136 wrote to memory of 1180	4136	explorer.exe	110
PID 4136 wrote to memory of 2936	4136	explorer.exe	111
PID 4136 wrote to memory of 2936	4136	explorer.exe	111
PID 4136 wrote to memory of 2936	4136	explorer.exe	111
PID 4136 wrote to memory of 5108	4136	explorer.exe	112
PID 4136 wrote to memory of 5108	4136	explorer.exe	112
PID 4136 wrote to memory of 5108	4136	explorer.exe	112
PID 4136 wrote to memory of 4628	4136	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a5b2929a9f0aed16fc5f1273337b8361_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:212
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:588
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4776
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4444
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2600
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4188
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1420
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2240
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3216
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4872
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3244
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4376
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1788
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:716
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2732
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 d1d3c2c9292fe1b9ae1878ae6362bfe87451c952615eb89bd38239886a0a5efc
MD5 46fb29b4fd0fa2632bcdb7e8393aa6c8
SHA1 2f15a40efac4fc325eef520d9e7819d7a4fd6fa5
SHA512 40c4d84510349cf357a586e25d6a162cec851755cfef27e83d18982eef52d56a8b2028906231972e52931813189a2a3b21a7339bf55c68d3cc93925f246671a6
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 0528ba02589a80ed269e85d33e65f0fe6ff33e0ac851d99948328edb6d1a9a3c
MD5 5f588175e4e348094f2b9e758b42f76b
SHA1 d46b7361587aaf8a65b946148b2e7cf522c591fd
SHA512 b29ed176f8ef394fdac5aa6ed990517239ddbb4003a806a769fbf012e05a3e7bb6d61c80b42a392259d4b434743e13544004f9fc7efcca160ab1982219f651af
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/212-4533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/212-4439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/212-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/232-1506-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/380-997-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/380-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/464-2323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/528-1508-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/588-1956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/588-2130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/620-3922-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/652-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/680-2669-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/716-4615-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/808-1195-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/932-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1060-2179-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1120-2521-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1128-2019-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1140-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1140-3260-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1180-1703-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1220-2957-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-4155-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-4159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-1980-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1508-4871-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1572-4842-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1616-2169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-1196-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1704-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1704-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1704-79-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1704-77-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1788-4278-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1788-4356-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1808-3081-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1812-4627-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1812-4623-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-1702-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-1957-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2084-830-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2088-1194-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2244-5544-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2272-3772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2376-998-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2384-4859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2440-3610-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2440-3472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2456-2596-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2516-3287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2516-3406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2532-5313-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2628-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2724-5107-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-5161-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-5280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2936-1704-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2988-5553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3132-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3132-996-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3268-2159-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3496-5016-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4012-3153-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4056-3143-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4152-1880-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4188-2850-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4188-2661-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-5321-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4272-1363-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4288-4102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-4212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4328-4829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4360-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-3013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4376-3989-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4376-4042-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4392-4445-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-2768-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-1954-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4432-3537-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-3859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-3687-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-2286-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-2149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-1955-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4572-2511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-1879-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4652-1968-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-1965-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4668-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4756-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4756-2316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4760-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4760-38-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4760-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4788-1964-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4928-5301-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-5449-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-2757-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4956-2760-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-5535-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-2947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-2944-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5108-1878-0x0000000000400000-0x00000000005D3000-memory.dmp

Download