pony | 44758d5e4d2b01b8d660d6c8430b5166018d580dc172c3f311220da5869c133d

Analysis

max time kernel
149s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
Size 2.2MB
Sample240613-vdaqfa1clk
SHA256 44758d5e4d2b01b8d660d6c8430b5166018d580dc172c3f311220da5869c133d
MD5 a697b73cd50194cdf3b115743968d0f7
SHA1 0822a8d88600ee53ad33bfd60ba195c8cca3f27d
SHA512 f305af0b36b4cefaedb415133465c8b52db6ce37825eee6b6892ea5139366056cd4bf151310570e637d16444d5f49f998dde9424d00d854a1d21d1cfcdb86e93
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3080	explorer.exe
1108	explorer.exe
2056	spoolsv.exe
672	spoolsv.exe
668	spoolsv.exe
3744	spoolsv.exe
940	spoolsv.exe
2248	spoolsv.exe
4156	spoolsv.exe
4828	spoolsv.exe
4404	spoolsv.exe
3212	spoolsv.exe
5080	spoolsv.exe
2428	spoolsv.exe
3732	spoolsv.exe
2920	spoolsv.exe
1116	spoolsv.exe
928	spoolsv.exe
4064	spoolsv.exe
1264	spoolsv.exe
4548	spoolsv.exe
4768	spoolsv.exe
3632	spoolsv.exe
4760	spoolsv.exe
3152	spoolsv.exe
116	spoolsv.exe
4952	spoolsv.exe
2004	spoolsv.exe
4316	spoolsv.exe
4604	spoolsv.exe
3680	spoolsv.exe
4892	spoolsv.exe
2120	spoolsv.exe
1092	explorer.exe
908	spoolsv.exe
4656	spoolsv.exe
4628	spoolsv.exe
2724	spoolsv.exe
3280	spoolsv.exe
1064	spoolsv.exe
1040	explorer.exe
1000	spoolsv.exe
1416	spoolsv.exe
4032	spoolsv.exe
2740	spoolsv.exe
4028	spoolsv.exe
4780	spoolsv.exe
2388	explorer.exe
5000	spoolsv.exe
3964	spoolsv.exe
4980	spoolsv.exe
2404	spoolsv.exe
220	spoolsv.exe
3260	spoolsv.exe
956	spoolsv.exe
4708	explorer.exe
4588	spoolsv.exe
4912	spoolsv.exe
4620	spoolsv.exe
3832	spoolsv.exe
2136	spoolsv.exe
1364	explorer.exe
2600	spoolsv.exe
624	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 4568 set thread context of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 3080 set thread context of 1108	3080	explorer.exe	95
PID 2056 set thread context of 2120	2056	spoolsv.exe	126
PID 672 set thread context of 908	672	spoolsv.exe	128
PID 668 set thread context of 4656	668	spoolsv.exe	129
PID 3744 set thread context of 2724	3744	spoolsv.exe	131
PID 940 set thread context of 3280	940	spoolsv.exe	132
PID 2248 set thread context of 1064	2248	spoolsv.exe	133
PID 4156 set thread context of 1000	4156	spoolsv.exe	135
PID 4828 set thread context of 4032	4828	spoolsv.exe	137
PID 4404 set thread context of 2740	4404	spoolsv.exe	138
PID 3212 set thread context of 4028	3212	spoolsv.exe	139
PID 5080 set thread context of 4780	5080	spoolsv.exe	140
PID 2428 set thread context of 3964	2428	spoolsv.exe	143
PID 3732 set thread context of 4980	3732	spoolsv.exe	144
PID 2920 set thread context of 2404	2920	spoolsv.exe	145
PID 1116 set thread context of 220	1116	spoolsv.exe	146
PID 928 set thread context of 956	928	spoolsv.exe	148
PID 4064 set thread context of 4588	4064	spoolsv.exe	150
PID 1264 set thread context of 4912	1264	spoolsv.exe	151
PID 4548 set thread context of 4620	4548	spoolsv.exe	152
PID 4768 set thread context of 2136	4768	spoolsv.exe	154
PID 3632 set thread context of 2600	3632	spoolsv.exe	156
PID 4760 set thread context of 624	4760	spoolsv.exe	157
PID 3152 set thread context of 4524	3152	spoolsv.exe	158
PID 116 set thread context of 32	116	spoolsv.exe	160
PID 4952 set thread context of 208	4952	spoolsv.exe	161
PID 2004 set thread context of 1852	2004	spoolsv.exe	163
PID 4316 set thread context of 3224	4316	spoolsv.exe	164
PID 4604 set thread context of 4084	4604	spoolsv.exe	166
PID 3680 set thread context of 2152	3680	spoolsv.exe	167
PID 4892 set thread context of 3784	4892	spoolsv.exe	171
PID 1092 set thread context of 2776	1092	explorer.exe	175
PID 4628 set thread context of 2116	4628	spoolsv.exe	177
PID 1040 set thread context of 5040	1040	explorer.exe	181
PID 1416 set thread context of 4652	1416	spoolsv.exe	183
PID 2388 set thread context of 3584	2388	explorer.exe	186
PID 5000 set thread context of 4392	5000	spoolsv.exe	187
PID 4708 set thread context of 868	4708	explorer.exe	192
PID 3260 set thread context of 2652	3260	spoolsv.exe	193
PID 3832 set thread context of 2712	3832	spoolsv.exe	197
PID 1364 set thread context of 2180	1364	explorer.exe	199
PID 380 set thread context of 3548	380	spoolsv.exe	202
PID 3676 set thread context of 644	3676	explorer.exe	205
PID 952 set thread context of 4944	952	spoolsv.exe	206
PID 4044 set thread context of 4088	4044	explorer.exe	207
PID 2032 set thread context of 5112	2032	spoolsv.exe	208
PID 3672 set thread context of 3572	3672	spoolsv.exe	210
PID 1540 set thread context of 4624	1540	explorer.exe	212
PID 2872 set thread context of 4948	2872	spoolsv.exe	213
PID 3016 set thread context of 2160	3016	spoolsv.exe	215
PID 3020 set thread context of 4692	3020	spoolsv.exe	217
PID 2316 set thread context of 2372	2316	explorer.exe	218
PID 4540 set thread context of 3748	4540	spoolsv.exe	220
PID 2424 set thread context of 4196	2424	spoolsv.exe	222
PID 1992 set thread context of 2644	1992	spoolsv.exe	224
PID 376 set thread context of 3048	376	explorer.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1108	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
1108	explorer.exe
2120	spoolsv.exe
2120	spoolsv.exe
908	spoolsv.exe
908	spoolsv.exe
4656	spoolsv.exe
4656	spoolsv.exe
2724	spoolsv.exe
2724	spoolsv.exe
3280	spoolsv.exe
3280	spoolsv.exe
1064	spoolsv.exe
1064	spoolsv.exe
1000	spoolsv.exe
1000	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
2740	spoolsv.exe
2740	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
4780	spoolsv.exe
4780	spoolsv.exe
3964	spoolsv.exe
3964	spoolsv.exe
4980	spoolsv.exe
4980	spoolsv.exe
2404	spoolsv.exe
2404	spoolsv.exe
220	spoolsv.exe
220	spoolsv.exe
956	spoolsv.exe
956	spoolsv.exe
4588	spoolsv.exe
4588	spoolsv.exe
4912	spoolsv.exe
4912	spoolsv.exe
4620	spoolsv.exe
4620	spoolsv.exe
2136	spoolsv.exe
2136	spoolsv.exe
2600	spoolsv.exe
2600	spoolsv.exe
624	spoolsv.exe
624	spoolsv.exe
4524	spoolsv.exe
4524	spoolsv.exe
32	spoolsv.exe
32	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
1852	spoolsv.exe
1852	spoolsv.exe
3224	spoolsv.exe
3224	spoolsv.exe
4084	spoolsv.exe
4084	spoolsv.exe
2152	spoolsv.exe
2152	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3508	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	81
PID 4568 wrote to memory of 3508	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	81
PID 4568 wrote to memory of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 4568 wrote to memory of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 4568 wrote to memory of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 4568 wrote to memory of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 4568 wrote to memory of 4976	4568	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	86
PID 4976 wrote to memory of 3080	4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	87
PID 4976 wrote to memory of 3080	4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	87
PID 4976 wrote to memory of 3080	4976	a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe	87
PID 3080 wrote to memory of 1108	3080	explorer.exe	95
PID 3080 wrote to memory of 1108	3080	explorer.exe	95
PID 3080 wrote to memory of 1108	3080	explorer.exe	95
PID 3080 wrote to memory of 1108	3080	explorer.exe	95
PID 3080 wrote to memory of 1108	3080	explorer.exe	95
PID 1108 wrote to memory of 2056	1108	explorer.exe	96
PID 1108 wrote to memory of 2056	1108	explorer.exe	96
PID 1108 wrote to memory of 2056	1108	explorer.exe	96
PID 1108 wrote to memory of 672	1108	explorer.exe	97
PID 1108 wrote to memory of 672	1108	explorer.exe	97
PID 1108 wrote to memory of 672	1108	explorer.exe	97
PID 1108 wrote to memory of 668	1108	explorer.exe	98
PID 1108 wrote to memory of 668	1108	explorer.exe	98
PID 1108 wrote to memory of 668	1108	explorer.exe	98
PID 1108 wrote to memory of 3744	1108	explorer.exe	99
PID 1108 wrote to memory of 3744	1108	explorer.exe	99
PID 1108 wrote to memory of 3744	1108	explorer.exe	99
PID 1108 wrote to memory of 940	1108	explorer.exe	100
PID 1108 wrote to memory of 940	1108	explorer.exe	100
PID 1108 wrote to memory of 940	1108	explorer.exe	100
PID 1108 wrote to memory of 2248	1108	explorer.exe	101
PID 1108 wrote to memory of 2248	1108	explorer.exe	101
PID 1108 wrote to memory of 2248	1108	explorer.exe	101
PID 1108 wrote to memory of 4156	1108	explorer.exe	102
PID 1108 wrote to memory of 4156	1108	explorer.exe	102
PID 1108 wrote to memory of 4156	1108	explorer.exe	102
PID 1108 wrote to memory of 4828	1108	explorer.exe	103
PID 1108 wrote to memory of 4828	1108	explorer.exe	103
PID 1108 wrote to memory of 4828	1108	explorer.exe	103
PID 1108 wrote to memory of 4404	1108	explorer.exe	104
PID 1108 wrote to memory of 4404	1108	explorer.exe	104
PID 1108 wrote to memory of 4404	1108	explorer.exe	104
PID 1108 wrote to memory of 3212	1108	explorer.exe	105
PID 1108 wrote to memory of 3212	1108	explorer.exe	105
PID 1108 wrote to memory of 3212	1108	explorer.exe	105
PID 1108 wrote to memory of 5080	1108	explorer.exe	106
PID 1108 wrote to memory of 5080	1108	explorer.exe	106
PID 1108 wrote to memory of 5080	1108	explorer.exe	106
PID 1108 wrote to memory of 2428	1108	explorer.exe	107
PID 1108 wrote to memory of 2428	1108	explorer.exe	107
PID 1108 wrote to memory of 2428	1108	explorer.exe	107
PID 1108 wrote to memory of 3732	1108	explorer.exe	108
PID 1108 wrote to memory of 3732	1108	explorer.exe	108
PID 1108 wrote to memory of 3732	1108	explorer.exe	108
PID 1108 wrote to memory of 2920	1108	explorer.exe	109
PID 1108 wrote to memory of 2920	1108	explorer.exe	109
PID 1108 wrote to memory of 2920	1108	explorer.exe	109
PID 1108 wrote to memory of 1116	1108	explorer.exe	110
PID 1108 wrote to memory of 1116	1108	explorer.exe	110
PID 1108 wrote to memory of 1116	1108	explorer.exe	110
PID 1108 wrote to memory of 928	1108	explorer.exe	111
PID 1108 wrote to memory of 928	1108	explorer.exe	111
PID 1108 wrote to memory of 928	1108	explorer.exe	111
PID 1108 wrote to memory of 4064	1108	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a697b73cd50194cdf3b115743968d0f7_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4976
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1040
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4708
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1364
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:32
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4044
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3784
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2116
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2316
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:376
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2160
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4196
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 a4fff43a37e2b7a26f3c0de2976b376caea174182be6ffce041e20bd6bc34c75
MD5 a9e200d62cd35d290cb7fa889a0cf7aa
SHA1 0010ddfaec85992abef8d87bc2cda3d3d6103814
SHA512 3a5eeb622b0b970e47014ba398ed19113c431a5a97d4e8277d813a0bd2ac3acd834c24bf89be6db1a28d38f86ad0cab51bcb4d30d26cf7152b22d09f83336ccb
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 542ddf8e897735a94e235caf8c6fb57037f9f3fc6c89a1d982f106d1a1aa8a19
MD5 d9300638f0187b50b942d7439b78b9f5
SHA1 9215ead51f9243d9cee76ffb761f3da3373ea375
SHA512 84e0829927dac3ebc949c17b85c2091007e8ea005c90d76646c91dcf9a90515cfaa2229d0e0c604da2744fda18c66cf85948004d6e6b2e6bbbc0231e9648083d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-2979-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/208-3121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-2411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-2415-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/624-2804-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/624-2807-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/668-988-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/668-1933-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/672-1923-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/672-987-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/868-4215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/908-1921-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/928-1768-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/940-1150-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/956-2573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1000-2126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-2115-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-2288-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-810-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1116-1767-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1264-1907-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1852-2986-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2056-1911-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2056-811-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2116-3599-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2116-3721-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-2098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2120-1910-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2136-2962-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2136-2787-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2152-3261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-4939-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2180-4446-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-1151-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2372-4958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2404-2401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2428-1479-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2600-2797-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2600-2795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-5179-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-5175-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2652-4223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2652-4331-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-4514-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-4419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2724-2022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2740-2226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2740-2221-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-3530-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-3528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2920-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3048-5187-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3048-5190-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3080-76-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3080-70-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3152-2021-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3212-1477-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3224-2998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3280-2033-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3548-4651-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-4807-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3584-3956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3632-1920-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3732-1652-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3744-989-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3748-5010-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3784-3437-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-2379-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-2238-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-2235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-2211-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4064-1769-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4088-4704-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4156-1302-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4196-5168-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4196-5303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4392-3964-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-1304-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4524-2816-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-1908-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4568-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4568-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4568-23-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/4568-0-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/4624-4815-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-3862-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-3937-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4656-1932-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4692-4948-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-1931-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4768-1909-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4780-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-2305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-1303-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4912-2593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-4695-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-4691-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4948-4821-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4948-4825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-59-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-57-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4976-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-2390-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-3799-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-1478-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5112-4733-0x0000000000400000-0x000000000043E000-memory.dmp

Download