pony | 53b0dc47b63fc78cce1f284e99d069517780348e911117899500bf2def7f251c

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
Size 2.2MB
Sample240614-blgn6syhmf
SHA256 53b0dc47b63fc78cce1f284e99d069517780348e911117899500bf2def7f251c
MD5 a77b2ae35edc5d96d13dcc3481d53bd6
SHA1 62d81ff8fbd17220123d79b02a97bcf4d84385cf
SHA512 0dae63995925dd9bb1111e8be2f6161fc8b8bd7e9e4f3f39ca7ca3a664c335c8f36b06f93b6e0429dcf7abdb6b5f7a7276d68e716b755f27c4b3f509615457fb
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWww5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1896	explorer.exe
1280	explorer.exe
3216	spoolsv.exe
208	spoolsv.exe
4620	spoolsv.exe
4572	spoolsv.exe
400	spoolsv.exe
380	spoolsv.exe
436	spoolsv.exe
2540	spoolsv.exe
2412	spoolsv.exe
1828	spoolsv.exe
220	spoolsv.exe
3360	spoolsv.exe
2344	spoolsv.exe
1424	spoolsv.exe
3464	spoolsv.exe
3120	spoolsv.exe
3740	spoolsv.exe
3608	spoolsv.exe
3796	spoolsv.exe
4076	spoolsv.exe
1992	spoolsv.exe
1564	spoolsv.exe
4312	spoolsv.exe
2712	spoolsv.exe
3408	spoolsv.exe
2320	spoolsv.exe
4472	spoolsv.exe
4960	spoolsv.exe
2044	spoolsv.exe
2904	spoolsv.exe
992	spoolsv.exe
4396	spoolsv.exe
4644	spoolsv.exe
2632	spoolsv.exe
4308	spoolsv.exe
5040	explorer.exe
4852	spoolsv.exe
1684	spoolsv.exe
2496	spoolsv.exe
4600	spoolsv.exe
4592	spoolsv.exe
3124	spoolsv.exe
4228	spoolsv.exe
4864	spoolsv.exe
3112	explorer.exe
2192	spoolsv.exe
2332	spoolsv.exe
1912	spoolsv.exe
2372	spoolsv.exe
4544	spoolsv.exe
2932	explorer.exe
1948	spoolsv.exe
2308	spoolsv.exe
4016	spoolsv.exe
4924	spoolsv.exe
1212	spoolsv.exe
748	explorer.exe
4484	spoolsv.exe
2152	spoolsv.exe
3836	spoolsv.exe
3164	spoolsv.exe
4704	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 47 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 1896 set thread context of 1280	1896	explorer.exe	92
PID 3216 set thread context of 4308	3216	spoolsv.exe	127
PID 208 set thread context of 4852	208	spoolsv.exe	129
PID 4620 set thread context of 1684	4620	spoolsv.exe	130
PID 4572 set thread context of 2496	4572	spoolsv.exe	131
PID 400 set thread context of 4600	400	spoolsv.exe	132
PID 380 set thread context of 3124	380	spoolsv.exe	134
PID 436 set thread context of 4228	436	spoolsv.exe	135
PID 2540 set thread context of 4864	2540	spoolsv.exe	136
PID 2412 set thread context of 2192	2412	spoolsv.exe	138
PID 1828 set thread context of 2332	1828	spoolsv.exe	140
PID 220 set thread context of 2372	220	spoolsv.exe	141
PID 3360 set thread context of 4544	3360	spoolsv.exe	142
PID 2344 set thread context of 1948	2344	spoolsv.exe	144
PID 1424 set thread context of 2308	1424	spoolsv.exe	145
PID 3464 set thread context of 4924	3464	spoolsv.exe	147
PID 3120 set thread context of 1212	3120	spoolsv.exe	148
PID 3740 set thread context of 4484	3740	spoolsv.exe	150
PID 3608 set thread context of 2152	3608	spoolsv.exe	151
PID 3796 set thread context of 3836	3796	spoolsv.exe	152
PID 4076 set thread context of 4704	4076	spoolsv.exe	154
PID 1992 set thread context of 2316	1992	spoolsv.exe	155
PID 1564 set thread context of 2648	1564	spoolsv.exe	156
PID 4312 set thread context of 3224	4312	spoolsv.exe	159
PID 2712 set thread context of 4100	2712	spoolsv.exe	160
PID 3408 set thread context of 1560	3408	spoolsv.exe	161
PID 2320 set thread context of 636	2320	spoolsv.exe	164
PID 4472 set thread context of 3728	4472	spoolsv.exe	165
PID 4960 set thread context of 3040	4960	spoolsv.exe	167
PID 2044 set thread context of 2008	2044	spoolsv.exe	168
PID 2904 set thread context of 3356	2904	spoolsv.exe	169
PID 992 set thread context of 1708	992	spoolsv.exe	171
PID 4396 set thread context of 2768	4396	spoolsv.exe	173
PID 4644 set thread context of 5112	4644	spoolsv.exe	174
PID 2632 set thread context of 4340	2632	spoolsv.exe	178
PID 5040 set thread context of 5056	5040	explorer.exe	182
PID 4592 set thread context of 2508	4592	spoolsv.exe	185
PID 3112 set thread context of 5020	3112	explorer.exe	188
PID 1912 set thread context of 3984	1912	spoolsv.exe	192
PID 2932 set thread context of 2432	2932	explorer.exe	195
PID 4016 set thread context of 244	4016	spoolsv.exe	202
PID 748 set thread context of 3912	748	explorer.exe	206
PID 3164 set thread context of 4820	3164	spoolsv.exe	208
PID 1456 set thread context of 2664	1456	explorer.exe	210
PID 4648 set thread context of 3280	4648	spoolsv.exe	212
PID 3872 set thread context of 3472	3872	explorer.exe	213

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
1280	explorer.exe
4308	spoolsv.exe
4308	spoolsv.exe
4852	spoolsv.exe
4852	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
2496	spoolsv.exe
2496	spoolsv.exe
4600	spoolsv.exe
4600	spoolsv.exe
3124	spoolsv.exe
3124	spoolsv.exe
4228	spoolsv.exe
4228	spoolsv.exe
4864	spoolsv.exe
4864	spoolsv.exe
2192	spoolsv.exe
2192	spoolsv.exe
2332	spoolsv.exe
2332	spoolsv.exe
2372	spoolsv.exe
2372	spoolsv.exe
4544	spoolsv.exe
4544	spoolsv.exe
1948	spoolsv.exe
1948	spoolsv.exe
2308	spoolsv.exe
2308	spoolsv.exe
4924	spoolsv.exe
4924	spoolsv.exe
1212	spoolsv.exe
1212	spoolsv.exe
4484	spoolsv.exe
4484	spoolsv.exe
2152	spoolsv.exe
2152	spoolsv.exe
3836	spoolsv.exe
3836	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
2316	spoolsv.exe
2316	spoolsv.exe
2648	spoolsv.exe
2648	spoolsv.exe
3224	spoolsv.exe
3224	spoolsv.exe
4100	spoolsv.exe
4100	spoolsv.exe
1560	spoolsv.exe
1560	spoolsv.exe
636	spoolsv.exe
636	spoolsv.exe
3728	spoolsv.exe
3728	spoolsv.exe
3040	spoolsv.exe
3040	spoolsv.exe
2008	spoolsv.exe
2008	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3724	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	81
PID 2196 wrote to memory of 3724	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	81
PID 2196 wrote to memory of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 2196 wrote to memory of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 2196 wrote to memory of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 2196 wrote to memory of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 2196 wrote to memory of 3524	2196	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	86
PID 3524 wrote to memory of 1896	3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	87
PID 3524 wrote to memory of 1896	3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	87
PID 3524 wrote to memory of 1896	3524	a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe	87
PID 1896 wrote to memory of 1280	1896	explorer.exe	92
PID 1896 wrote to memory of 1280	1896	explorer.exe	92
PID 1896 wrote to memory of 1280	1896	explorer.exe	92
PID 1896 wrote to memory of 1280	1896	explorer.exe	92
PID 1896 wrote to memory of 1280	1896	explorer.exe	92
PID 1280 wrote to memory of 3216	1280	explorer.exe	93
PID 1280 wrote to memory of 3216	1280	explorer.exe	93
PID 1280 wrote to memory of 3216	1280	explorer.exe	93
PID 1280 wrote to memory of 208	1280	explorer.exe	94
PID 1280 wrote to memory of 208	1280	explorer.exe	94
PID 1280 wrote to memory of 208	1280	explorer.exe	94
PID 1280 wrote to memory of 4620	1280	explorer.exe	95
PID 1280 wrote to memory of 4620	1280	explorer.exe	95
PID 1280 wrote to memory of 4620	1280	explorer.exe	95
PID 1280 wrote to memory of 4572	1280	explorer.exe	96
PID 1280 wrote to memory of 4572	1280	explorer.exe	96
PID 1280 wrote to memory of 4572	1280	explorer.exe	96
PID 1280 wrote to memory of 400	1280	explorer.exe	97
PID 1280 wrote to memory of 400	1280	explorer.exe	97
PID 1280 wrote to memory of 400	1280	explorer.exe	97
PID 1280 wrote to memory of 380	1280	explorer.exe	98
PID 1280 wrote to memory of 380	1280	explorer.exe	98
PID 1280 wrote to memory of 380	1280	explorer.exe	98
PID 1280 wrote to memory of 436	1280	explorer.exe	99
PID 1280 wrote to memory of 436	1280	explorer.exe	99
PID 1280 wrote to memory of 436	1280	explorer.exe	99
PID 1280 wrote to memory of 2540	1280	explorer.exe	100
PID 1280 wrote to memory of 2540	1280	explorer.exe	100
PID 1280 wrote to memory of 2540	1280	explorer.exe	100
PID 1280 wrote to memory of 2412	1280	explorer.exe	101
PID 1280 wrote to memory of 2412	1280	explorer.exe	101
PID 1280 wrote to memory of 2412	1280	explorer.exe	101
PID 1280 wrote to memory of 1828	1280	explorer.exe	102
PID 1280 wrote to memory of 1828	1280	explorer.exe	102
PID 1280 wrote to memory of 1828	1280	explorer.exe	102
PID 1280 wrote to memory of 220	1280	explorer.exe	103
PID 1280 wrote to memory of 220	1280	explorer.exe	103
PID 1280 wrote to memory of 220	1280	explorer.exe	103
PID 1280 wrote to memory of 3360	1280	explorer.exe	104
PID 1280 wrote to memory of 3360	1280	explorer.exe	104
PID 1280 wrote to memory of 3360	1280	explorer.exe	104
PID 1280 wrote to memory of 2344	1280	explorer.exe	105
PID 1280 wrote to memory of 2344	1280	explorer.exe	105
PID 1280 wrote to memory of 2344	1280	explorer.exe	105
PID 1280 wrote to memory of 1424	1280	explorer.exe	106
PID 1280 wrote to memory of 1424	1280	explorer.exe	106
PID 1280 wrote to memory of 1424	1280	explorer.exe	106
PID 1280 wrote to memory of 3464	1280	explorer.exe	107
PID 1280 wrote to memory of 3464	1280	explorer.exe	107
PID 1280 wrote to memory of 3464	1280	explorer.exe	107
PID 1280 wrote to memory of 3120	1280	explorer.exe	108
PID 1280 wrote to memory of 3120	1280	explorer.exe	108
PID 1280 wrote to memory of 3120	1280	explorer.exe	108
PID 1280 wrote to memory of 3740	1280	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3724
- C:\Users\Admin\AppData\Local\Temp\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a77b2ae35edc5d96d13dcc3481d53bd6_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2932
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3872
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4332
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4044
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2572
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2880
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3984
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4584
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3068
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1648
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 c439dfc621dd85ac9a3c5862255ed6786d96248547ed59d0ce590479be3ddff4
MD5 05924d9db27f872910c83aa1d0dc645b
SHA1 9b7f278796b317109d2b88f1ce3c7b9833cb6ee0
SHA512 65e6f763920574f98a526868275f9efe6959110604fa7af9aafb3572bbcb35334b04983e422b61f0f4dfb8c3547d7f9120041244b27d72571df9c5eade697795
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 d5d5c70a2727fe927593df2803c77d77f49c4866e1b65a4a73c1dc58c6170d61
MD5 b5a85ee52df4699b72f2b3351f90d9db
SHA1 a4f3b4ddf226fff7d38f7eb4c9e6d88876ca6af0
SHA512 5418f146426597d705972772b63bf2592cc5c6100ffa6919979691f41eea85ca248ac3025845b933a1418f45868ae5bcabf7508a9b4cbb6bc4b3f5d827f4f738
SSDEEP 49152:0UzeyQMS4DqodCnoe+iitjWwwvUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUN:02emw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-2358-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/208-1181-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/220-1752-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/244-5045-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/244-4928-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/380-1365-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/400-1364-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/436-1366-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/636-3368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1164-6198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1212-3094-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1212-2903-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1280-99-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1280-999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1424-1755-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1560-3278-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1560-3427-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1564-2346-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1648-5787-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1648-5934-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1684-2370-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1708-3756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1828-1569-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1896-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1896-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1948-2750-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1992-2345-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2008-3464-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2152-2923-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2192-2565-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2196-0-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/2196-48-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/2196-52-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2196-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2308-2771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-3050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2344-1754-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2372-2648-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2412-1568-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2432-4701-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2432-4705-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2496-2381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-4392-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2508-4278-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2540-1567-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2648-3120-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-5219-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2692-5874-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-2369-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2756-5631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-3622-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-3454-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-5621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-5759-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3124-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-1000-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3216-2348-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3224-3200-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3224-3202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3356-3529-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3356-3485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3360-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3464-1964-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3472-5400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3520-6189-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3524-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3524-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3524-67-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3524-51-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3608-2180-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3728-3445-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3740-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3796-2181-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3836-2932-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3912-5118-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-4551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4076-2182-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4100-3223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-3219-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4228-2490-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4308-2526-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-2355-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4340-3894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-6260-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-6064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-2913-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-2870-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-2731-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-1183-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4620-2371-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4620-1182-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4704-3036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-3040-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-6180-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-6402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-5207-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-5376-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4852-2356-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4864-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-2819-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5016-5795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5020-4463-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5044-6032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5044-6147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-4115-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-4118-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-3632-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5164-6315-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5760-6422-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5848-6431-0x0000000000400000-0x000000000043E000-memory.dmp

Download